Security Policy

The governing version of this document. Questions: support@sitescanreport.com.

SiteScanReport LLC · Effective Date: September 1, 2026 · Last Updated: September 1, 2026

This Security Policy describes the technical and organizational safeguards SiteScanReport LLC ("SiteScanReport") maintains to protect the data and systems that support the Service at sitescanreport.com.

Infrastructure Security

Cloud Infrastructure. The Service runs entirely on infrastructure hosted by Amazon Web Services (AWS) in the us-east-1 (N. Virginia) region. AWS maintains SOC 2 Type II, ISO 27001, PCI DSS Level 1 service provider validation, and FedRAMP authorizations. Details are available at aws.amazon.com/compliance.

Encryption at Rest. Customer email addresses, submitted URLs, scan metadata, scan results, and report PDFs stored in Amazon S3 are encrypted at rest using AES-256 via AWS Key Management Service (KMS). Access to stored data and related encryption controls is restricted to the system components and administrative access paths that require it.

Encryption in Transit. Data transmitted between the Service and end users is encrypted using TLS 1.2 or higher. Connections to third-party service providers used to operate the Service are made over industry-standard encrypted channels.

Secrets Management. API credentials and service keys used for payment-related operations, transactional email, security screening, and AI-assisted report generation are stored in AWS Secrets Manager and retrieved only by authorized service components as needed.

Access Controls. Each component of the Service operates under a dedicated AWS IAM role with permissions limited to the minimum necessary for its function. No component has broad or shared access to system resources.

Payment Security

SiteScanReport uses Stripe, Inc. and Stripe Checkout to process payments. Payment card data is collected and processed through Stripe-hosted checkout infrastructure. SiteScanReport does not store, process, or have direct access to full payment card numbers or CVV codes on its own systems or servers.

Application Security

Webhook Security. Stripe Checkout and payment webhooks are validated using HMAC-SHA256 signature verification before processing. Requests with invalid or missing signatures are rejected.

Abuse Prevention. The Service maintains technical measures designed to reduce abusive, automated, or disruptive use of public-facing endpoints, including rate limiting. Before a scan runs, we screen the submitted address against Google Web Risk, Google's service for identifying known unsafe web resources, and we may decline to scan an address that appears on a threat list.

Portal Authentication. Access to the customer portal is authenticated by email verification using Amazon Cognito, an AWS service. We send a one-time sign-in code to your email address, and access is granted only after that code is verified.

Dependency Management. Third-party software dependencies are tracked and reviewed for known security vulnerabilities, and applicable security updates are applied based on operational needs and risk.

Data Handling

Minimal Data Collection. We collect only the information necessary to deliver the Service, including your email address, the URL you submit, and order metadata. We do not collect payment card data. See our Privacy Policy for additional detail.

Data Retention. We retain data only as long as we need it and then delete it. Because you receive and keep your own copy of every report, we do not retain scan data indefinitely. Public content fetched from a submitted URL during a scan is used only to generate the report and is discarded once that processing is complete. Scan results are retained for up to 90 days. Report PDFs are retained for up to 12 months to support portal re-download and refund or dispute resolution. Order metadata (email address, scan ID, and Stripe payment intent ID) is retained for up to 24 months to support refunds, disputes, and legal recordkeeping. Payment records and payment card data retained by Stripe are subject to Stripe's policies. Retained scan records are held in tamper-resistant storage so that they cannot be altered in the ordinary course, while remaining deletable by us through a controlled, audited process, including to honor a valid deletion request or to remove content we are required to remove. See our Privacy Policy for how to request deletion.

No Data Selling. We do not sell, rent, or share customer data with third parties for advertising, marketing, or any commercial purpose unrelated to delivering the Service.

Operational Security

Monitoring and Alerting. The Service uses AWS CloudWatch and automated alerting to monitor errors, failures, and other anomalous operating conditions and to notify the operator when investigation or action is required or may be required.

Incident Response. SiteScanReport maintains internal procedures for identifying, investigating, containing, and remediating security incidents, including incidents involving customer data, and continues to develop those procedures over time. If a security incident requires notice under applicable law, we will provide notice to affected customers and, where required, applicable authorities in accordance with applicable law.

Vulnerability Disclosure. If you discover a security vulnerability in the Service, please report it to support@sitescanreport.com. We ask that you provide us a reasonable opportunity to investigate and remediate the issue before any public disclosure. We do not pursue legal action against researchers who report vulnerabilities in good faith.

Third-Party Service Providers

We use the following third-party service providers in delivering the Service. As described in our Privacy Policy, each receives only the information reasonably necessary to perform its function on our behalf.

Questions

Security questions or vulnerability disclosures may be sent to support@sitescanreport.com.

SiteScanReport LLC support@sitescanreport.com sitescanreport.com