Last updated 15 October 2026

Security

A tool that looks at your website, and sometimes signs in to it, has to be trustworthy. This page describes what we do to earn that, and is deliberately specific.

Your data

Credentials you give us (signed-in scan logins, integration tokens) are encrypted with AES-256-GCM and bound to your workspace, so a copied value will not open anywhere else. They are never shown again after saving.
API keys are shown once; only a SHA-256 hash is stored. Keys are scoped (read or write for scans, reports and projects) and can be revoked at any time.
Data is stored on Google Cloud (Firestore and Cloud Storage), which encrypts data at rest, and travels over TLS.
Evidence screenshots are private to your workspace and served only through authenticated requests.

Workspace isolation

Every record belongs to a workspace and every request is checked against workspace membership and role on the server. Browsers cannot read or write most data directly: database rules deny client writes and server-only collections entirely.
Public share links and client portals expose only a sanitised report view, expire, can be password-protected, and can be revoked. Reports from signed-in scans cannot be shared publicly at all.

Access control

Roles (owner, admin, member, viewer) limit who can scan, change settings, manage billing or see audit logs.
Two-step verification with authenticator apps and recovery codes. Teams and Enterprise workspaces can require it for every member.
Enterprise: single sign-on (OIDC and SAML) and SCIM provisioning. Teams and above: IP allow-lists.
Sessions can be reviewed and revoked; sensitive actions ask you to sign in again first.
An audit log records sign-ins, permission changes, integrations, exports and other sensitive actions on paid plans.

Safe scanning

Scanners fetch pages the way a visitor would and do not attack your site. Scans are read-only by default and respect robots.txt unless you change that setting.
Our crawler cannot be pointed at internal networks: requests to private, loopback, link-local and cloud-metadata addresses are blocked, including after redirects and DNS changes.
Deeper features such as signed-in scanning require you to verify that you control the domain, and the crawl is limited to the hosts you verified.

Application security

Incoming webhooks (payments, deployments, ticket updates) are verified with signatures before anything is processed, and outgoing webhooks we send are signed.
Requests are rate-limited per account and per address. Security headers such as HSTS are set on every response.
We scan ourselves with the same tools and keep dependencies under review. Findings we accept are recorded with a reason and an expiry date.

What we do not claim

We do not currently hold a SOC 2 report or ISO 27001 certificate, and we do not claim to. We have not published the results of an independent penetration test. If your procurement process needs either, tell us what you need through the contact form and we will answer honestly.

Scan results are automated observations, not certifications, audits or legal advice.

Report a vulnerability

If you believe you have found a security problem in Web Compliance Suite, please e-mail security@webcompsuite.com with enough detail to reproduce it. Our security.txt has the same contact.

We will acknowledge your report within three business days and keep you informed.
Please give us reasonable time to fix the problem before you disclose it, and do not access other people's data, degrade the service, or run automated attacks against production.
Good-faith research that follows these rules will not be pursued legally by us.

We do not run a paid bounty programme at this time.