Updated 8 Oct 2026
Trust centre.
The outside record of trust, held to its own standard: how we handle data, and what we hold. Each statement below is true as written. Where something is not in place, we say so.
Status in wordsDated changesNo certification claimed
At a glance8 Oct 2026
Two-step sign-in for staff, reps and partnersIn place
Encrypted database backupsIn place
Card dataHeld by Stripe
SOC 2Not held
External penetration testNot held
Hosted in the United StatesRead-only assessments
01 · Status
What is in place, planned and not held.
SOC 2
Not held
Not held. Planned, no audit underway. We do not claim it.
External penetration test of our own systems
Not held
Not commissioned, and no engagement is underway.
Two-step sign-in
In place
Required for staff, sales representatives and partner portal owners and administrators. Customers can turn it on.
Customer pages: one-time code by email
In place
A customer’s assessment and monitoring pages open only after a 6-digit code is emailed to an address already on that customer’s record and entered on the page. The link alone does not open them. A code works once, for 10 minutes. The browser an order was placed from can open that order’s page for two hours without one.
HTTPS with HSTS
In place
All traffic is served over HTTPS, with HSTS set for one year.
Encrypted database backups
In place
Backups are encrypted with AES-256-GCM before they are copied off-site. The key is held outside the code repository.
Payment card data
In place
Held by Stripe. Card numbers never reach our systems.
Separate production environment
In place
Production runs in its own hosted environment, apart from development machines. Every deployment is recorded by the hosting provider.
Every paid assessment human-verified
In place
Every paid assessment is held until a person has reviewed and approved it for release.
Sign-in rate limiting
In place
Repeated failed sign-ins are rate limited and the originating address is blocked automatically.
Vulnerability reporting
In place
security.txt and [email protected]. Reports are acknowledged within 72 hours.
Third-party certification
Not held
We follow the FTC's published data security guidance and the fair information principles in PIPEDA. That is our own practice, not a certification or a regulator's approval.
02 · Data handling
What we keep, why, and for how long.
| Data | Why | How long |
|---|---|---|
| Check inputs (addresses, domains) and the originating IP address | To run and record the check, and to prevent abuse | Kept until you ask us to delete it |
| Account data (name, email) | To sign you in and operate your account | While the account exists; deleted when you ask |
| Delivered documents | So you can open them again from your dashboard | Kept until you ask us to delete them |
| Payment data | Processed by Stripe; never stored on our systems | Per Stripe |
| Usage analytics | None. No analytics or advertising trackers, and no cookie notice to answer | Per the cookie policy |
Where it is storedHosted in the United States
Email deliveryA US email delivery provider
Mailing listsA check adds you to none
The same statement appears on the methodology page and in the privacy policy.
03 · Contact
Three ways to reach us.
Report a vulnerability
Acknowledged within 72 hours, with a status update within 7 days. We do not pursue legal action against good-faith researchers.
Security questionnaire
Written answers to a security questionnaire, or our retention and deletion policy, shared under a confidentiality agreement.
Privacy rights
Access, correction, deletion or a portable copy of what we hold about you. We answer within 30 days. Requests go to our Privacy Officer.
04 · Changelog
Real changes, dated.
8 Oct 2026
Customer pages open with a one-time code
A customer’s assessment and monitoring pages now open only after a one-time code is emailed to an address on that customer’s record. Before this they opened for anyone who held the link.
3 Oct 2026
No trackers
Google Analytics removed from every page, with its cookie notice. The site now runs no analytics or advertising trackers.
29 Sep 2026
Analytics off until consent; retention stated as it is
Google Analytics loads only after the cookie notice is accepted. A phone number or address never travels in a page address. The privacy policy and this page state the real retention rule: kept until you ask us to delete it.
28 Sep 2026
Two-step sign-in required; database backups encrypted
Two-step sign-in became mandatory for staff, sales representatives and partner portal owners and administrators, and optional for customers. Off-site database backups are encrypted with AES-256-GCM before upload.
27 Sep 2026
Every paid assessment held for a person
Every paid assessment is held until a person has reviewed and approved it for release.
Sep 2026
This page corrected
Compliance badges and certification language removed. Every statement describes only what is in place today.