Security and privacy.
You're trusting us with a record of your accessibility work. Here is how we keep it safe, and what we deliberately don't collect.
Tenant isolation
Every organization's sites, scans and data are scoped to its own account. No customer can see another's data. That is enforced on every query and every API route, not just in the interface.
We only read public pages
The scanner loads your public URLs the way a browser does. We don't ask for your CMS logins, your database or server access to do our job.
API keys are hashed
We store only a SHA-256 hash of each API key, never the key itself. A key is shown once when you create it and can be revoked instantly.
Encryption in transit
All traffic runs over HTTPS/TLS. Sessions use signed, HTTP-only, secure cookies, and integrations authenticate with bearer tokens.
Least data by design
We keep scan results and remediation history, not your visitors' personal data. There's no tracking pixel and no resale of data.
Watched around the clock
Scanpoof watches its own site the way it watches yours: uptime checks every few minutes and certificate-expiry warnings, so problems are caught fast.
Security questionnaires and data processing agreement (DPA) requests are welcome. Email [email protected].
Found a security problem?
Email [email protected] with “Security report” in the subject, the steps to reproduce it and what you think the impact is. We read every report, reply to say we have it, and tell you when it's fixed. Please give us a reasonable time to fix it before you share it, and don't access other customers' data, run denial-of-service tests or send spam while you look. Our contact details for researchers are also in security.txt.
Ready to see where your site stands?
Scan a page free, or start a 14-day trial and monitor every site daily.