Skip to main content
Trust

Security & Trust

How we protect your account, your sites, and your customers' data - written to be specific about what we actually do, and honest that no online service can promise perfect security.

Last updated: July 8, 2026 · Version 1.2

Encryption everywhere

  • The entire service is served over HTTPS (TLS), with HSTS so browsers only connect securely
  • Every published customer site gets free, automatic SSL - including custom domains, whose certificates are issued and renewed automatically at no cost
  • Credentials you entrust to us (e.g. your own SMTP details) are encrypted at rest with authenticated AES-256-GCM - and never returned to the browser once saved
  • Passwords are stored only as salted bcrypt hashes (work factor 12) - never in plain text

Account protection

  • Two-factor authentication (TOTP) with single-use recovery codes on every account
  • 2FA sign-in challenges are short-lived and single-use - a redeemed challenge cannot be replayed
  • Per-device sessions you can review and revoke remotely ("sign out all other devices")
  • Access tokens rotate on refresh; a password change or reset instantly invalidates every previously issued token
  • OAuth sign-in verifies anti-forgery state on every callback

Tenant isolation

  • Every account's data is scoped by a central ownership layer - one customer can never read or modify another's projects, orders, or contacts
  • Isolation is continuously verified by automated cross-tenant tests that attempt (and must fail) to access another account's data
  • Public identifiers are opaque tokens, not guessable sequential numbers

Abuse & rate protection

  • Atomic rate limiting on every public endpoint - login, forms, comments, checkout, subscriptions
  • Escalating lockouts for repeat offenders, plus email-relay caps so forms can't be scripted into spamming third parties
  • Disposable-address screening and MX validation on collected emails; spam-content scoring before campaigns send
  • Optional per-site geo controls to block or allow visitors by country

Content & link safety

  • Four-layer content moderation on published content and AI prompts: curated word lists, profanity detection (including leetspeak evasion), AI moderation, and malicious-URL screening
  • Publish-time gates keep banned content off live sites even if it was drafted
  • Email click-tracking redirects are cryptographically signed, so they can't be abused as open redirects

Payments

  • Card data never passes through or gets stored on our servers
  • Subscriptions are processed by Creem, our Merchant of Record, and store payments by Stripe - both PCI-DSS-compliant providers
  • Every payment webhook is signature-verified before it is trusted

Privileged access

  • Platform administration is protected by role-based access control, login throttling, and audit logging, with IP allow-listing available to restrict administrative access
  • Dual audit trails record user actions and every administrative action separately
  • Support impersonation uses one-time, expiring tokens and is flagged to the audit trail

Engineering practice

  • Static analysis with custom security-minded rules runs on every change; new code cannot merge with violations
  • An automated test suite - including the cross-tenant isolation checks - gates every release
  • CI scans for leaked secrets and vulnerable dependencies
  • Security telemetry feeds real-time dashboards, including alerts when a protective control degrades

Your data, your rights

  • Export your complete account data or delete your account (full cascade) at any time, self-serve
  • GDPR-aligned processing with a signable Data Processing Agreement for your own sites' visitor data
  • Sub-processors are listed publicly and kept current

The fine print, in plain language

1. Payments & billing

We never see or store your full card details. Subscription payments are processed by Creem, which acts as our Merchant of Record, and store/e-commerce payments by Stripe - both PCI-DSS-compliant payment providers. Card data is entered directly into their secure checkout; it does not pass through or get stored on our servers, and their webhooks are signature-verified before we act on them.

2. Encryption

  • In transit: the entire Service is served over HTTPS (TLS), with HTTP Strict Transport Security (HSTS) enforced so browsers only ever connect securely. This covers the websites you publish with us too: every site - on a Webkio subdomain or your own custom domain - gets a free SSL certificate that is issued and renewed automatically.
  • At rest: sensitive secrets you entrust to us - such as your own SMTP or integration credentials - are encrypted at rest using authenticated AES-256-GCM encryption, and are never returned to the browser after being saved.
  • Passwords: stored only as salted one-way bcrypt hashes - never in plain text, never recoverable by us.

3. Account & access security

  • Optional two-factor authentication (authenticator-app TOTP) with single-use recovery codes. Sign-in challenges expire after five minutes and can be redeemed exactly once.
  • Sessions are tracked per device; you can review active devices and revoke any of them - or all others at once - from your settings.
  • API tokens are short-lived and rotate on refresh. Changing or resetting your password immediately invalidates every token issued before that moment, so a stolen token does not survive a reset.
  • Administrative access to the platform is restricted by role-based access control (RBAC), with IP allow-listing available to further limit access, and dual audit trails of privileged actions.
  • Your data is isolated per account (multi-tenant scoping) so one customer cannot access another's projects or data - and our release pipeline includes automated tests that try, and must fail, to cross that boundary.

4. Content safety & abuse prevention

To keep the platform and the wider web safe, we run automated content-safety and abuse controls, including:

  • automated moderation of content submitted through the Service, including AI generation prompts, which blocks sexual, hateful, violent, and other harmful or unlawful content;
  • malware, phishing, and malicious-URL screening using reputable safe-browsing / threat-intelligence sources;
  • rate limiting on every public endpoint, spam filtering, escalating lockouts, and fraud- and account-abuse detection;
  • a channel to report abuse, which we review promptly.

See our Acceptable Use Policy for what is and isn't allowed.

5. Data protection & your rights

We process personal data in line with the GDPR. You can export your account data or delete your account at any time from your settings. When your published sites collect personal data from their own visitors, you are the controller and we act as your processor under our Data Processing Agreement. The third-party providers (sub-processors) we rely on are listed in our Privacy Policy and GDPR notices.

6. Infrastructure & reliability

The Service runs on reputable managed cloud infrastructure with encrypted, automated database backups and least-privilege access to production systems. We monitor availability, errors, and security signals on real-time dashboards - including alerts that fire if one of our own protective controls degrades - and apply security updates to our stack.

7. What we don't claim

We don't hold formal certifications such as SOC 2 or ISO 27001 at this time, and we won't put badges on this page that we haven't earned. What you read above is what is actually built, enforced in code, and tested on every release.

8. Responsible disclosure

If you believe you have found a security vulnerability, please report it to us at [protected] (see also our security.txt). Please give us a reasonable opportunity to investigate and fix the issue before any public disclosure. We are grateful for good-faith research and will not pursue action against researchers who act responsibly and avoid privacy violations, service disruption, or data destruction.

9. Contact

[protected]
[protected]