Trust & Security

How AllyProof protects your data and maintains operational security.

Last updated: 23.10.26

Hosting and Data Region

AllyProof’s primary application servers run in Germany. Browser collection regions depend on the selected check: California privacy checks run in California.

Primary database storage uses EU-based PostgreSQL infrastructure. Collection regions, global edge services and external processing providers are separate from the primary storage location. Review the privacy policy and applicable data-processing agreement for processing details.

Static assets and edge caching are served via a global CDN with points of presence worldwide.

Encryption and Transport Security

  • Transport: Public AllyProof endpoints use HTTPS and security response headers. Custom HTTP endpoints configured in the extension do not provide encrypted transport.
  • Stored data: Our managed database provider supplies encryption-at-rest controls. Confirm current backup encryption and recovery arrangements with us for your security review.
  • API keys: Our server database stores SHA-256 hashes and identifying metadata, not the original key. The key is returned once on creation; a CLI or other client can store your copy locally. Revocation disables the key but does not delete its metadata.
  • Passwords: Our managed authentication provider hashes passwords; we do not store plaintext passwords.

Authentication and Session Security

  • Sign-in supports email/password, Google and GitHub. OAuth uses PKCE (Proof Key for Code Exchange).
  • Supabase manages cookies and automatic session refresh. Authentication cookies are accessible to the browser client, not HttpOnly; token expiry and revocation determine session validity separately from cookie lifetime.
  • Row Level Security (RLS) and server-side authorization restrict access to organization data.
  • Role-based permissions distinguish owners, admins, members, guests and billing access. Paid features do not grant administrative permissions.

Data Retention and Deletion

Removing a site deactivates it; existing scan results, reports and evidence remain stored. Contact us to request erasure.

  • User accounts: Email-verified account deletion removes the sign-in account and memberships. It does not itself erase shared organization records or cancel subscriptions.
  • Evidence: Scans, reports and audit history remain with the organization or site until deleted or an authorized erasure request is fulfilled. Referenced screenshots are preserved; unreferenced screenshot objects older than 2 days are eligible for batched cleanup. There is no general 90-day audit-history purge.
  • Analytics: First-party event records have a 400-day retention period. These can be pseudonymous or account-linked, not necessarily anonymous. Google measurement requires the applicable consent.
  • AI: Bounded task data can contain personal information. Evidence and results may be retained by AllyProof; provider retention depends on the service and agreement. We do not make a universal zero-retention promise. See the privacy policy for the detailed retention rules and request process.
  • Trial eligibility: Billing email and plan-related eligibility records survive account and organization deletion and have no automatic expiry. The privacy policy explains their purpose and the erasure and objection process.

Backup and Disaster Recovery

  • Database backups: Contact our team for current backup schedules and recovery arrangements during your security review.
  • Report storage: Report data and VPAT-based evidence drafts are stored in the application database. Screenshots and some downloadable artifacts use object storage. This separation is not an independent backup of report data.
  • Recovery time: Any contractual recovery commitment must be specified in your service agreement.
  • Recovery point: Confirm the agreed recovery scope and backup interval with our team for your deployment requirements.

Vulnerability Disclosure / Security Contact

If you discover a security vulnerability in AllyProof, please report it responsibly:

  • Email: security@allyproof.com
  • Please include a description of the vulnerability, steps to reproduce, and any relevant screenshots or logs.
  • We will acknowledge receipt within 48 hours and provide an initial assessment within 5 business days.
  • We do not pursue legal action against security researchers who act in good faith.

Incident Response Contact

For active security incidents or data breach notifications:

  • Emergency: security@allyproof.com with subject line “INCIDENT”
  • General support: support@allyproof.com
  • We notify affected customers without undue delay and within 72 hours of becoming aware of a personal-data breach. Where we act as a processor, we notify the relevant controller without undue delay. GDPR Article 33 concerns notification to the supervisory authority, where required, within 72 hours of awareness where feasible; Article 34 requires notifying affected individuals without undue delay where the breach is likely to create a high risk.

Accessibility Testing Limitations

AllyProof uses automated scanning tools (axe-core, HTML_CodeSniffer) to detect accessibility issues. It is important to understand the limitations of automated testing:

  • Automated testing covers only part of accessibility conformance. In Deque's published audit dataset, automated testing identified 57.38% of recorded accessibility issues. That is a share of issue volume, not the share of WCAG success criteria that can be fully evaluated automatically, and actual coverage varies by site.
  • Automated scans cannot evaluate subjective criteria such as whether alt text is meaningful, whether content order is logical, or whether a user experience is truly accessible.
  • A clean automated scan does not guarantee full WCAG conformance. Manual expert testing, assistive technology testing, and user testing are also necessary.
  • AllyProof exports proprietary VPAT-based DRAFT assessments, not the official ITI report form or completed ACRs. A qualified accessibility professional must complete the official report before procurement use.
  • AllyProof does not provide legal advice. Scan results should not be interpreted as a legal compliance assessment.

Browser Extension

  • Local scans: Quick scans run locally without an account. Saving results, requesting AI fixes and starting server crawls transmit the task data described in the privacy policy; authenticated operations may refresh tokens automatically.
  • Page access: Bundled content-script listeners load automatically on permitted HTTP(S) pages. Scans run on request. Chrome and Edge request activeTab, tabs, storage, scripting and sidePanel; Firefox uses the first 4. No browser-history permission is requested.
  • Storage: The latest 50 scans persist locally. Access and refresh credentials are held in session storage, with refresh credentials also in local storage. Server access tokens last 90 days and refresh tokens 180 days. Credentials and scan history are not synchronized through chrome.storage.sync.
  • Code and telemetry: Code is bundled in the store package. There is no implemented telemetry sender or third-party tracking SDK in the current extension.
  • Distribution: Chrome Web Store, Microsoft Edge Add-ons and Firefox Add-ons provide store distribution and updates.

Sub-Processors

Providers support hosting, database and authentication, delivery, security and AI processing. AI features may use OpenAI, Anthropic or Google Gemini depending on configuration; retention depends on the applicable service and agreement, not a universal zero-retention arrangement. Paddle is our Merchant of Record; its contracting entity depends on the purchase. Paddle and certain optional Google services act as independent controllers for their own processing rather than as our sub-processors.

Request current providers, processing locations and data-processing terms at legal@allyproof.com. Customers with a Data Processing Agreement are notified in advance of material sub-processor changes under that agreement.