Security
Updated
We keep as little data as we can, and protect what we keep. This page describes how.
Hosting and data
- The website, database, scanning service and stored files are in the EU (Railway, Amsterdam region).
- All traffic to and from Perceivly is encrypted with TLS. Stored data is encrypted at rest by our providers.
- We never store IP addresses, only a keyed one-way hash used to limit abuse.
- Email confirmation tokens are stored only as hashes and expire after 48 hours.
- Scan results and screenshots are deleted automatically after 90 days.
How the scanner is isolated
The checker opens pages that strangers type in, so it is built not to reach anything private. Every request the scanning browser makes, including redirects, embedded frames, images and WebSockets, goes through a proxy that resolves the address itself and connects only to public internet addresses. Requests to private networks, loopback addresses and cloud metadata services are refused, even after a redirect. The scanning browser carries no cookies or credentials, and each check runs in a fresh browser context that is closed afterwards.
Reporting a vulnerability
If you find a security issue, please email [email protected] with the details and steps to reproduce it. We’ll acknowledge your report, keep you informed, and credit you if you wish. Please don’t access other people’s data, degrade the service, or publish the issue before we’ve fixed it. We won’t take legal action against good-faith research that follows these rules. Our security.txt has the same contact.