Security
Security
How we protect the site, the data behind it and the websites we check, and how to tell us about a problem.
Encrypted connections
- Every page and request uses HTTPS, and browsers are told to use nothing else.
- A strict content policy lets pages run only our own scripts and Cloudflare’s visitor count, and other sites can’t frame our pages.
Stored data
- The site, its database and its files run on Cloudflare, which encrypts stored data.
- We keep only what we need, for as long as our privacy policy says. A PDF you check is read in memory and never stored.
How the scanner runs
- It reads only public pages, in a browser Cloudflare runs apart from our database and keys.
- It never signs in, submits a form or gets around a block, and every scan has a time limit. About our scanner explains more.
Who can reach the data
- Our back office sits behind Cloudflare Access, which sends a one-time code to named people only, and the site checks Access’s signed pass itself as a second lock.
- Keys and passwords are kept in Cloudflare’s secret store, never in our code.
- Sign-in links we email expire, and the one cookie we set can’t be read by scripts.
How changes reach the site
Every change is reviewed and must pass five sets of automated checks, for accessibility, phone layouts, search, the site’s security settings and the words on every report, before it can go live. Our code repository refuses any change that hasn’t passed.
Payments
Payments for PDF repair go through Stripe. Your card details go straight to Stripe and never reach us.
Reporting a security problem
If you find a security problem, tell us through our contact form. We acknowledge every report within two business days and keep you told of our progress.
- Please give us a reasonable time to fix it before you make it public.
- Don’t look at, change or delete other people’s information, and don’t disrupt the site, for example by flooding it with requests.
- We won’t take action against research done in good faith within these rules.
Our security.txt file points researchers’ tools here.
For buyers
We answer security questionnaires for procurement. Ask through our contact form.