Security overview
Effective .
Last updated 1 August 2026.
The product measures other people's security for a living, which makes a vague page here indefensible. This describes what is actually implemented rather than what is aspired to.
Workspace isolation
Every record that belongs to a workspace carries its workspace's identifier, and every query the application makes is scoped to it automatically rather than by each query remembering to filter. There is one deliberate exception: the operator console, which reads across workspaces to answer support and billing questions. It is a single, named code path that requires an operator account, two-factor authentication and a recent password confirmation, and writes every read to an audit trail.
Cross-workspace isolation has its own test suite, run as a separate job on every change, because one agency seeing another's prospects is the highest-consequence failure this product has.
The scanners are read-only
The audit engine runs a fixed set of checks against a prospect's public surface: its website as a browser would fetch it, its DNS records, its TLS certificate, its public headers, and published registry data. It follows the same rules a search engine crawler does.
It does not attempt authentication, does not submit forms, does not attempt to exploit anything it finds, and does not scan hosts a customer has not asked about. Rate limits are applied per target. Using the results to attack a system is a breach of the terms and, in most jurisdictions, of the law.
Data in transit and at rest
All traffic is served over TLS 1.2 or better, with HSTS. Data at rest is encrypted by the storage layer, and secrets such as API credentials and integration tokens are encrypted in the database with a key held outside it. Passwords are hashed with bcrypt; we cannot read them.
Generated reports and uploaded media live in a private bucket with no public URL. A report shared with a prospect is served through an unguessable link that the customer can revoke.
Access control
Access to production is limited to the people who operate the service, requires two-factor authentication, and is reviewed when anyone joins or leaves. Application access to a customer workspace by our staff is limited to operating the service or helping with a problem you have raised, and is logged.
Inside a workspace, roles govern what a member can do; sending outreach is gated behind an explicit human approval step that cannot be automated away.
Sending safeguards
Suppression is enforced when a message is drafted, not only when it is sent, so an address that unsubscribed cannot re-enter a follow-up sequence through any route. Every message carries a working unsubscribe link, a one-click List-Unsubscribe header, the identity of the sending agency and a postal address.
Resilience
Databases are backed up daily with point-in-time recovery, and backups are encrypted and held in the same region as the primary. Restores are tested. Backups age out on their own retention cycle, which is why deleting a record removes it from the live service immediately and from backups as they expire.
Development practice
Changes are reviewed before they ship, and the test suite, including static analysis and the isolation suite above, runs on every one. Dependencies are monitored for published vulnerabilities and patched on a severity-driven schedule. Errors in production are captured with request metadata and an acting user id, and no message bodies.
Reporting a vulnerability
Email hello@siteassay.com with enough detail to reproduce the issue. We will acknowledge within 3 working days and keep you updated until it is resolved.
Test only against your own workspace and your own domains. Do not access another customer's data, do not run denial-of-service or volumetric tests, and give us reasonable time to fix an issue before disclosing it. Research conducted within those bounds is welcome and we will not pursue action over it.
What we do not claim
We hold no SOC 2 or ISO 27001 certification today. Saying so plainly is more useful than a page of implications: if your procurement process requires one, tell us. It is a matter of when, and knowing that a customer is blocked on it moves it up the list.