Loading…
We sell tools that help you find leaked data — so we obsess about not leaking yours. Here’s exactly how we protect your account, your queries and your wallet.
All traffic is TLS 1.2+. Database is encrypted at rest with AES-256. Backup snapshots are encrypted. Sensitive secrets are stored in environment-scoped vaults, never in source.
Hosted on Vercel and Supabase, both SOC 2 Type II certified. EU-region database. Automatic daily backups with 7-day point-in-time recovery.
Row-level security on every user-scoped table. Server-side API key never exposed to the browser. Internal access requires SSO + hardware MFA.
HSTS, X-Frame-Options, strict Content-Security-Policy, signed cookies, CSRF-resistant routes, and signature verification on every payment webhook.
Every credit consumption, payment event and admin action is logged with an immutable audit trail. Customers can export their full activity log on request.
24-hour acknowledgement on critical reports. 72-hour breach notification to affected customers per GDPR Art. 33. Public post-mortems within 7 days.
Full data-subject rights workflow, signed DPA on request, EU data residency by default.
Supabase and Vercel are both SOC 2 Type II certified. We pass through their controls and layer our own on top.
Card data never touches our servers — Mollie is a PCI-DSS Level 1 service provider.
Targeting certification within 12 months of public launch.
We welcome reports from independent security researchers. If you believe you’ve found a vulnerability, please follow the guidelines below.