Your scan results, site logins and billing details are sensitive. This page explains how we protect them, and how to tell us if you find a problem.
Report a vulnerability
Email [email protected] with what you found and how to reproduce it. We reply within two business days, keep you updated while we fix it, and credit you if you’d like. Please give us a reasonable time to fix an issue before you share it publicly, and don’t access other people’s data or disrupt the service while testing. Our security.txt has the same details in a machine-readable form.
Infrastructure we build on
We don’t run our own data centres. We use providers that are independently audited. The certifications below are theirs, not ours.
| Provider | What it does for AiroPages | Certifications |
|---|---|---|
| Railway | Hosts the app, scanners and databases | SOC 2 Type II, SOC 3 |
| Paddle | Payments, tax and invoicing (merchant of record) | SOC 2 Type II, PCI DSS |
| Cloudflare | DNS, DDoS protection and Turnstile bot checks | ISO 27001, SOC 2 Type II |
| Resend | Sign-in links, reports and alerts by email | SOC 2 Type II |
Paddle handles card details on its own secure checkout. AiroPages never sees or stores your card number.
How we protect your account
- Passwords are hashed with Argon2id. We can’t read them.
- Two-factor authentication with an authenticator app is available on every account, and required for our staff.
- Sessions use secure, HttpOnly cookies. You can see your active sessions and sign out of any of them in Settings.
- API keys are stored as hashes. The full key is shown once, when you create it.
- Sign-in protection: repeated failed attempts are rate limited and lock the account temporarily.
How we protect your data
- In transit: HTTPS everywhere, with HSTS, so browsers never connect over plain HTTP.
- Secrets at rest: logins you save for password-protected staging sites are encrypted with AES-256-GCM.
- Browser hardening: a strict Content Security Policy, no framing of our pages, and cross-site request checks on the API.
- Least access: staff access to customer accounts is limited and logged in an audit trail.
Safe scanning
AiroPages is built to scan public websites. Page discovery refuses private, internal and cloud metadata addresses, including after redirects, and a scan that ends up on one is thrown away. Include and exclude rules are matched in a way that can’t be abused to slow the system down.
Your data, your call
Export all your data or delete your account at any time from Settings. We don’t sell personal data. See the Privacy Policy for retention periods and the Cookie Policy for every cookie we use.
Contact
- Security reports: [email protected]
- Account help: [email protected]
- Everything else: [email protected]