Security,
in plain terms.

Protecting the data

Encryption in transit

All traffic is served over HTTPS/TLS.

Encrypted storage

Data is stored on managed, encrypted cloud infrastructure.

Sessions and MFA

Secure server-side sessions, with optional multi-factor authentication.

Role-based access

Owner · Admin · Editor · Viewer: each workspace member gets only the permissions of their role.

Server-side authorization

Every protected request is authenticated and authorized on the server, never trusted from the client.

Who can change what

Draft and publish

Nothing is shown until an explicit publish.

Version history and rollback

A product's answer keeps its version history and can be restored.

Change log

Every change to a product's answer is recorded: who changed what, and when.

What a scan records, and what it doesn't

E-label pages record nothing

The /e/ page shows the mandatory information only and keeps no metrics about the visitor.

Shopper pages count visits, not people

A visit is counted with an identifier derived from the IP address and browser that changes every day. The IP address itself is not stored in the metrics. What is stored: the context, the device type and browser family, the referring page, and an approximate location (city level).

No cookie from a scan

Opening a product page sets no cookie and needs no account. Technical server logs keep request data, including the IP address, for security and troubleshooting.

Planned

• Planned · SOC 2
• Planned · ISO 27001
• Planned · Approval before publishing

Formal certifications (SOC 2, ISO 27001) and multi-step approval before publishing: planned.

Questions about security?

Ask us directly. We answer in the same plain terms.