Security
Firewall configs show exactly how a network is protected, so we designed the service never to receive them. Here’s how it works, and how you can check it.
Your config stays in your browser
- The review engine, the converter, the change review, hit-count analysis and the PDF report all run as JavaScript in your browser tab.
- The config is held only in the page’s memory. It isn’t saved to local storage, and it’s cleared when you leave the page or sign out.
- No config text, hostname, IP address, rule name or finding is sent to our servers or anyone else’s.
Free tools
The free network tools also run in your browser. DNS and registry lookups go straight from your browser to public services (Cloudflare and Google DNS-over-HTTPS, the internet registries and crt.sh), not through us. Those pages have their own security policy that allows only those services. The Workbench pages, where configs are pasted, keep the strict policy below.
The browser enforces it
Every page is served with a Content-Security-Policy that only lets the page connect to our own site, our account database (Supabase) and our payment provider (Paddle). Even a bug in our code couldn’t send your config to anywhere else, because the browser would block the request.
Check it yourself
- Open the Workbench and your browser’s developer tools (F12), then the Network tab.
- Paste a config and run a review.
- Look at each request. You’ll see a call that records the review: the platform, rule count, score, grade and number of findings. No request contains your config.
- To be fully sure, disconnect from the network after the page has loaded. The review still runs. Only the usage record fails.
What we do store
| Data | Why |
|---|---|
| Your account, company, team members and plan | Sign-in, billing and plan limits |
| Usage records: time, platform, rule count, score, grade, finding counts | Plan limits and your company’s history |
| Device records (paid plans): your label and a salted SHA-256 fingerprint of the hostname, made in your browser | Score history per device. We can’t reverse it to the hostname. |
| Accepted risks: a salted fingerprint of the finding, check type, severity, your reason and expiry | Your risk register |
| Review sign-offs: who, when, the score and counts, your note | Audit evidence for periodic rule reviews |
| Client names and logos (MSP plan) | Client folders and report branding |
| Vulnerability scanner (paid add-on): verified scan targets, profiles/schedules, a one-way hash of each scanner licence, and the hosts and vulnerabilities found by scans | Run authorised scans and show results. A scan can only run against a target you have verified you control; scans do version/configuration matching, not exploitation. |
| Assets you list for monitoring (paid plans): platform, model, software version, and only if you enter them, a name and IP addresses | Daily matching against public vulnerability data, and alerts. Kept separate from the Workbench: nothing from a config is added to your assets. |
Each company has its own secret salt, so fingerprints can’t be matched across companies. Notes and reasons are free text that you type: don’t put IP addresses, hostnames or passwords in them.
How the service is run
- Hosted on Cloudflare Pages over HTTPS only, with HSTS and strict security headers.
- Accounts and data in Supabase (PostgreSQL), with row-level security so one company can never read another’s data. Changes go through database functions that check your role.
- Card payments, VAT and invoices are handled by Paddle as merchant of record. We never see card numbers.
- Passwords are handled by Supabase Auth and stored hashed. Two-factor sign-in (authenticator app) is available, and we recommend it for owners and admins.
- Old usage records are deleted after 24 months. See the privacy notice.
Reporting a vulnerability
If you find a security issue, email with the details. Please don’t test against other customers’ accounts or data. We’ll reply within 3 working days and credit you if you’d like. Our security.txt has the same details.