You hand us client findings. Here is how we treat them.

Accounts

• Passwords are hashed with scrypt.We never store a password, and we cannot read it.
• Two-factor sign-in is required.Every account sets up an authenticator app before it can open anything, and it cannot be turned off. You get recovery codes in case you lose the phone.
• Sessions live in an HttpOnly cookie.Scripts on the page cannot read it. Repeated failed sign-ins are slowed down.
• Changes to your account are mailed to you.A new email address must be confirmed before it replaces the old one.

The web app

• Nothing is loaded from other sites.Fonts, scripts and the PDF viewer all come from our own server. There are no analytics or advertising scripts. A strict content security policy enforces it.
• Text you type is never treated as markup.The app builds its pages without inserting your text as HTML, and report text is escaped before it is printed.
• Requests from other sites are refused.Every change needs a header only our own page sends, and its origin is checked.
• The app cannot be placed in a frame on another site.This stops click-jacking.

Files you upload

• Scanner files are read with a safe parser.External entities and DTD tricks are refused, and size, depth and count are capped. A crafted XML file cannot read other files or exhaust the server.
• Pictures are checked by their content.A file is accepted as a screenshot only if its bytes are really a PNG, JPEG or WebP, and only up to a fixed size.
• Report generation cannot reach the internet.The PDF engine blocks every network request, so text inside a report cannot pull in remote content.

Your data

• Each account is separate.Projects, library and scanner results belong to one account and are never shown to another.
• You can export or delete it.Deleting your account deletes every project in it.

Where it lives

• One server in the European Union.Projects, screenshots, scanner files and the database are stored on a virtual server we rent from Contabo, in an EU data centre. They are not copied to any other service.
• Traffic is encrypted in transit.The site and the app use HTTPS only. The app sits behind Cloudflare, which carries the traffic and ends the encrypted connection, so it does see requests as they pass.
• The server is locked down.Only SSH, HTTP and HTTPS are open. Sign-in to the server needs a private key, not a password. Repeated failed attempts are blocked and security updates install automatically.

Who else handles data

• Contabo: hosting.Runs the server. Holds your data, as described above.
• Cloudflare: DNS, traffic and email forwarding.Carries web traffic to the app and forwards mail sent to our own addresses.
• Resend: email we send you.Receives your address and the text of messages such as the confirmation link. It never receives your reports.
• Lemon Squeezy: payments for Pro.Takes your card details and acts as the seller of record. We never see or store card numbers.

Report content goes to none of them except as it passes through Cloudflare to reach our server. There are no analytics or advertising services.

Backups and deletion

• A backup every night, kept for 14 days.A consistent copy of the database and project files, readable only by the server's administrator.
• Deleted projects are erased after 7 days.A project you delete waits in Recently deleted in case it was a mistake, and you can restore it yourself. Only your last 5 deleted projects are kept. Then it is erased for good.
• Deleting your account is immediate.Every project, screenshot and setting is erased. Copies in the nightly backups disappear when those backups expire, within 14 days.
• Unused Free accounts.A Free account unused for 12 months may be deleted, after an email at least 30 days before.