Loading…
Site diagnosis only ever touches your website's public surface. Even so, we layer defences around the customer data we do store.
Last updated: 18 August 2026
Every URL is validated synchronously before reaching the Celery queue: scheme whitelist (http/https only), full block on private IP ranges (RFC1918, loopback, link-local, and the AWS EC2 metadata endpoint 169.254.169.254), and DNS re-resolution at Playwright load time to defeat TOCTOU attacks.
User-owned data is isolated at the database layer using PostgreSQL Row-Level Security (RLS), with an ownership check repeated at the API layer. If application code regresses, RLS remains the backstop — never our only line of defence.
Passwords are hashed with bcrypt (cost factor ≥12). Access JWTs are short-lived (15 min); refresh tokens are 30-day, single-use, and rotated on every refresh — theft detection invalidates the entire token family. Platform admins require TOTP MFA; enterprise users get SAML 2.0 SSO.
TLS 1.2+ in transit. At rest: AWS RDS transparent encryption (TDE) and S3 server-side encryption (AES-256). API secrets live in AWS Secrets Manager — never in the codebase.
Playwright scans run in isolated ECS Fargate micro-VMs — one per scan — torn down on completion. Resource limits (CPU, memory, network) are enforced to contain malicious sites and prevent lateral movement.
Every request emits structured JSON logs (scan_id, hashed user_id, pillar, duration, cache_hit, error_code). Platform-admin actions land in an immutable audit table. Traces flow to AWS X-Ray.
SAGBRAIN CORPORATION, which operates this service, has held ISO/IEC 27001 certification since January 2022 and runs an information security management system under it.
Registered scope
Japan's Act on Protection of Personal Information (post-2022 amendment).
EU General Data Protection Regulation — for EU-based visitors.
Our own UI meets WCAG 2.2 AA. axe-core runs as a CI gate.
Threat model baselined against OWASP Top 10 (2021).
Email the address below. We follow coordinated disclosure and respond within 1 business day. Researchers are credited in our Hall of Fame and may be eligible for a bounty (¥10,000–¥500,000 depending on severity).
AuditToDesk is not within the current registered scope, but is built and operated under the same company's ISMS. The certification can be verified in the public ISMS-AC registry.