Security

Each scan runs in its own fresh browser on Cloudflare, can only reach public addresses, and never signs in to your shop unless you give it a test login. Report a problem to us by email and we’ll answer within 2 working days.

How scans are isolated

• Every visitor in a scan is a fresh browser profile: no cookies, storage or earlier choices, thrown away afterwards.
• Every address is checked before it loads, so a scan can’t be pointed at a private network or our own systems.
• Service workers and downloads are switched off in the scan browser.
• We only visit public pages, unless you add a login for a test account so we can check pages behind it.

How your account is protected

• Passwords are hashed, never stored as text. Session cookies are HTTP-only and secure.
• Payments go through Paddle, our Merchant of Record. We never see card numbers.
• API tokens are stored hashed, and you can turn them off in Settings at any time.
• What we keep and for how long is in the privacy policy. Deleting your account deletes your sites, scans and screenshots straight away.

Report a vulnerability

Email hello@untick.io with the steps to reproduce. Please don’t access other people’s data or disrupt the service while testing. We’ll reply within 2 working days and keep you posted until it’s fixed. Our security.txt has the same details.