Security

Security is part of how the Service is built, not an afterthought. We collect as little as we can, there is no email wall to run a scan, secret keys stay on the server, and everything is served over encrypted connections. Below is what that means in practice.

The scanner reads your site the way a search engine does. It requests public pages only: your homepage and, if they exist, robots.txt, sitemap.xml, llms.txt and a few of the public pages listed in your sitemap. It does not log in, submit forms, or change anything on your server.

Because you give us a URL to fetch, we make sure the scanner can only reach the public web and never internal systems:

• Only public http and https addresses are allowed.
• Private network ranges and cloud metadata addresses are blocked, and every redirect is re-checked against the same rules.
• Per-IP rate limits keep the free scan from being used to drive up cost or hit other sites in bulk.

Our AI provider key and all analysis run on the server and never reach your browser. Secret keys live in protected environment variables, not in our code or our public repository.

The website and our API are served over HTTPS. When we send your site's content to our AI provider for analysis, it travels over an encrypted connection using our own key.

When paid fixes are available, payments are handled by Stripe. Your card details go straight to Stripe and never touch our servers. We receive only a confirmation that the payment went through.

We store only what we need to run the Service, such as your scan report and, if you order, your order details. We do not sell your data. For the full detail and the rights you have over it, see our Privacy Policy.

If you find a security problem, please email us at hello@howfindable.com. We read these quickly. We ask that you give us a reasonable chance to fix the issue before sharing it publicly, and that you do not access, change or delete other people's data while testing.

Our contact is also published, in the standard format, at /.well-known/security.txt.

We take reasonable technical and organisational measures to protect your data, but no system or transmission is ever completely secure, so we cannot promise absolute security.