Security

The same standard we apply to measuring AI systems applies to protecting what is entrusted to us. We take practical steps, describe them plainly, and do not overstate them.

The most reliable way to protect information is not to collect it. There are no accounts and no passwords. We never see card details — payment happens on Stripe’s own checkout. Our measurement work concerns publicly available information about businesses and markets.

Raw scanned page text is retained while we operate this service, in access-controlled systems. Ask us and we will delete yours.

We run on established platforms rather than systems we built ourselves — Railway for hosting and the database, Stripe for payments, and Resend for transactional email. We rely on their security programs alongside our own practices.

• Paid content is gated on the server. A free result is a genuinely redacted object — locked content is never sent to the browser and hidden with styling. It is simply not present.
• Report links are signed. Each is an unguessable token bound to one specific assessment; altering it invalidates it. Entitlement is re-checked on every request, so a valid link to an unpaid report still refuses.
• The scanner refuses internal targets. It resolves and rejects private, loopback and link-local addresses, bounds redirects and response size, and will not follow a redirect into a blocked address.
• Secrets stay on the server. Configuration is validated at startup and the process refuses to boot if a secret-like value has been exposed to the browser.
• The database connection uses TLS in production, with certificate verification enabled.
• Logs are redacted. Credentials, cookies and authorization headers are stripped before anything is written.

Access to company systems and customer information is limited to those who need it to do the work, and administrative access is separate from everyday access and protected by multi-factor authentication.

There is no public sign-up and we hold no passwords. Private client portal access is created by us for a named person and used through a personal link rather than a password you have to remember. The link carries a signature we verify on every request, so it cannot be altered to reach anything it was not issued for, and we can switch one person’s access off without affecting anyone else’s. Documents downloaded from the portal are stamped with the name they were issued to. We never see card details — payment happens on Stripe’s own checkout.

No system, service or organization can be guaranteed perfectly secure, and we will not tell you otherwise. If we become aware of an incident affecting your information, we will act promptly and communicate honestly about what we know.

If you believe you have found a security issue, please write to reports@vizcayaintelligence.com. We will acknowledge you and look into it. Please give us a reasonable opportunity to fix an issue before disclosing it publicly.