Security overview
One-page summary for security reviewers and procurement. For detailed terms see our DPA and subprocessors list. Report issues to security@consentsignals.com.
Scanning safety (SSRF)
Every submitted URL is validated before crawl: DNS resolution, blocklists for localhost/private/metadata IPs (including decimal and hex IP encodings), redirect re-checks, and per-domain scan cooldown. Deep and authenticated scans require DNS domain verification.
Authentication & authorisation
Clerk JWTs verified server-side. Scan results and PDF downloads are owner-only. Agency share links expose read-only completed scans via opaque tokens. Admin endpoints require Clerk admin allowlist plus break-glass secret on the API tier only.
Worker isolation
Playwright scan workers run with SERVICE_ROLE=worker and must not load ADMIN_SECRET in production. Stripe webhooks and admin routes stay on the API service. See .env.worker.example for the split.
Billing integrity
Stripe webhooks require a valid Stripe-Signature header; unsigned payloads are rejected. Tier changes are audit-logged.
Report integrity
PDF reports are signed with HMAC-SHA-256. Public verify pages expose metadata and HMAC prefix only — not full tracker dumps or cookies.
Export safety
CSV exports prefix formula-injection characters (=, +, -, @) so spreadsheet tools cannot execute attacker-controlled cells.
Encryption
TLS in transit for all customer-facing endpoints. Database hosted on Supabase (EU) with provider-managed encryption at rest.
Secrets & production hardening
Production refuses to start without signing keys, admin secret (API), Clerk secret, and Stripe webhook secret. Secrets are never committed to git. Agent API keys are stored as SHA-256 hashes.
Rate limiting & abuse prevention
Public POST endpoints are rate-limited. Free tier caps enforced per IP hash. Redis-backed per-domain scan cooldown reduces abuse. Anonymous scan retention TTL purges stale rows.
Audit logging
Sensitive actions append to an audit_logs table (PDF download, tier changes, admin retries, share revokes). View and filter at /admin → Audit log.