Legal
Security
Last updated: July 22, 2026
We're an early-stage company (see about) — this page is an honest account of our real, current security practices. We do not hold SOC 2, ISO 27001, or any other formal security certification, and we won't claim one until it is real.
Data in transit
PingMyBrand is HTTPS-only in production (no plain-HTTP entry point) with HTTP Strict Transport Security enabled — browsers are told to enforce HTTPS on every future visit, including preload-list submission, so even a first request can't be silently downgraded.
Passwords & auth
Passwords are hashed with scrypt and a unique per-user salt — we never store or can read your plaintext password. Sessions use signed, httpOnly cookies. You can revoke all active sessions at once from your account page.
Payments
Billing runs through a Stripe-hosted Checkout Session — your card number is entered on Stripe's own page, not ours. PingMyBrand's servers never see or store full card details.
Browser-level protections
Every response carries a real, verifiable set of security headers: a Content-Security-Policy (nonce-based, scoped to the scripts/styles/origins this app actually loads), X-Content-Type-Options, X-Frame-Options, a strict Referrer-Policy, a locked-down Permissions-Policy (no camera/microphone/geolocation access), Cross-Origin-Opener-Policy, and Origin-Agent-Cluster isolation.
Abuse & cost protection
Public endpoints (scans, report generation) are rate-limited per IP and metered against a real monthly spend cap, so a single abusive actor can't exhaust the service or run up unbounded infrastructure cost for everyone else.
What we don't have yet
No formal penetration test, no SOC 2/ISO 27001 certification, and no dedicated security team — honest, proportionate to our current stage. We revisit this as the company and customer base grow.
Found a vulnerability? Email hello@pingmybrand.com with "Security" in the subject — we read every message and will respond directly.