Trust Center

CheckFox is published by Crofte Studio S.à r.l.-S, Luxembourg (RCS B310079), and run by one person. That is stated plainly because it should shape the questions you ask: there is no security team, no on-call rotation and no certification body behind this page. What there is instead is listed below, and each point can be checked.

• The infrastructure is managed by established providers (database, hosting, network), not hand-built servers.
• Your audits can be exported from the interface at any time, without asking me.
• Commitments that depend on one person being available are published as objectives, with their limits, in the service levels.

Your audit content is stored in the European Union. Providers used for payments, email, automated scans, AI features and audience measurement are listed with their safeguards in the sub-processor register.

• Passwords are stored only as salted hashes.
• Optional two-factor authentication. Once enabled, it is enforced by the database itself: a session that has not passed the second factor cannot read protected data, even outside the interface.
• Sensitive actions ask for the password again: creating an API key, changing a member's role, changing billing, deleting the account.
• Changing the password signs out every other session.
• Every workspace member has a role (Owner, Moderator, Editor, Reader), and least privilege is the default.
• Row-level security on every table that holds user data: the database refuses to return another workspace's rows even if the application has a bug.
• Sensitive fields such as billing identifiers and integration tokens can never be read or changed from the browser.

• Every request is authenticated, then checked against the specific resource it touches. A resource you cannot see answers "not found", so its existence is not revealed.
• Input is validated, and writes accept only an explicit list of fields.
• Rate limits on sign-in, invitations, password checks, scans and AI requests.
• Server-side requests to addresses you supply (for example a page to scan) cannot reach internal or private networks.
• Content you write in reports, notes and statements is sanitised before it is displayed, and uploaded images are cleaned of active content.
• An enforced Content Security Policy, strict transport security and the usual protective headers on every page.
• Payment webhooks are verified by signature, and a plan changes only once the payment provider confirms it.
• Integration tokens and your own AI provider keys are stored encrypted, are only usable by the server, and are never sent back to the browser.
• API keys are stored hashed, carry explicit permissions and expire after one year.

• Every AI request goes through the server, which checks the account, the workspace and the plan first. The browser never holds a model provider key.
• Your content is not used to train AI models.
• Text you type and code from audited pages are passed to the model as data, never as instructions.
• A workspace may use its own AI provider key instead; requests then go to that provider under your own agreement with it.

• Encryption in transit (TLS) everywhere, and at rest for the database and file storage.
• Server secrets are held in the providers' secret stores, never in the code or in the browser.
• The service running on the origin server is isolated from everything else on that machine: its own system account, a restricted sandbox, reachable only through the web server, and unable to modify its own code.

• The database provider takes daily backups and keeps them for 7 days, in the European Union.
• CheckFox takes its own backup every 6 hours and keeps the last 8, in France.
• Those backups are encrypted with a public key before they leave the server. The private key needed to read them is kept offline, so neither the server nor the storage provider can decrypt them.
• Uploaded files (screenshots, logos, attachments) are copied within 15 minutes, encrypted with the same public key, to France. The copy of a deleted file is removed 7 days later.
• The backup process connects to the database with a read-only account: it cannot change production.
• A restore is a deliberate, manual operation. It cannot be triggered from the web.
• Deleted data disappears from every backup within 35 days at the latest.

The recovery objectives (maximum data loss, time to restore) are in the service levels.

• A separate staging environment, with its own database and a sandbox payment account, where every change is tested before production.
• Database changes are written as reviewed migrations, applied to staging first, then to production.
• Automated tests, linting and dependency checks before every deployment. Server dependencies are pinned to exact versions.
• Deployments run with least-privilege credentials and refuse a server whose identity does not match.

Full security audits were carried out in May 2026 and October 2026. The October audit combined a code review, live testing of staging and production, and an item-by-item test checklist. Every critical and high finding was fixed and verified on staging before it shipped to production.

These audits are internal. CheckFox has not yet been tested by an independent penetration testing firm. If your organisation requires one, you may commission it under the conditions of section 12 of the Data Processing Agreement.

• If a personal data breach affects your data, I notify you within 48 hours of becoming aware of it, as set out in section 10 of the Data Processing Agreement.
• Every breach is recorded in an internal register, including those that do not require notification.
• Service incidents are communicated as described in the service levels.
• Vulnerabilities can be reported under the security disclosure policy.

• Only the data the service needs is collected.
• Audience measurement without cookies and without storing IP addresses.
• No selling of personal data, no advertising, no tracking across sites.
• Export and account deletion are self-service.

The providers underneath hold certifications for the layers they operate, and each publishes them:

• Supabase: SOC 2 Type 2.
• Amazon Web Services: ISO 27001, SOC 2, among others.
• OVHcloud: ISO 27001.
• Cloudflare: ISO 27001, SOC 2 Type 2.
• Stripe: PCI DSS Level 1. Card numbers never reach CheckFox.

• The detailed security documentation, of which this page is the public summary.
• Your security questionnaire, completed.
• A counter-signed copy of the Data Processing Agreement.
• A summary of the latest security audit and of how its findings were fixed.

Write to the address below. No non-disclosure agreement is needed; I only ask that these documents are used for your evaluation and not republished.