Trust Center

Audityxe is a stateless audit tool: scans run against public HTTP responses and site manifests only, with no server access or code execution against the target site.

1. Data retention

Audit results are computed per request and returned directly to you. They are not stored server-side beyond the usage counter needed for rate limiting.

2. Account security

• Authentication via Firebase Auth, with email verification required to run audits.
• Session tokens expire and are re-issued on sign-in; there is no persistent server-side session store.
• All traffic is served over HTTPS/TLS.

3. Infrastructure

Hosted on Vercel with Firebase (Auth + Firestore) as the backend. See the Third-Party Services page for the full sub-processor list.

3a. Email authentication (SPF, DKIM, DMARC)

Transactional email (verification links, password resets) is sent via Firebase Authentication's own mail infrastructure, which is already SPF/DKIM-aligned for its sending domain. If a custom sending domain is configured later, that domain's DNS must publish an SPF record authorizing the sender, DKIM signing keys, and a DMARC policy (starting at p=none for monitoring, then tightened top=quarantine/p=reject) before it is used for authentication email.

4. Abuse prevention

IP-level and account-level rate limits, atomic quota checks, and duplicate/concurrent request protection are enforced on every audit request.

5. Reporting an issue

If you find a security issue, please report it via the Contact page rather than public disclosure.