Security

Authentication

You can sign in with Google, with an email address and password, or with a one-time link sent to your email. We never see your Google password. Passwords we do handle are stored only as a salted scrypt hash, which is deliberately slow to compute and cannot be reversed. Sessions are signed tokens tied to your account, and every page of the application checks them server-side.

Payments

Card details are entered directly into Razorpay's checkout and never reach our servers — we hold no card numbers to lose. Every payment we act on is verified twice: the result returned to your browser carries a cryptographic signature we check, and we then re-read the authoritative status from Razorpay before granting anything. Our payment webhook is signature-verified and refuses to run at all if its signing secret is missing, rather than falling back to trusting whatever it receives.

Cookieless, first-party analytics

Traffic Intelligence and Heatmaps run on our own lightweight pixel — not Google Analytics. It sets no cookies and does no cross-site tracking. To count unique visitors we derive a keyed one-way hashfrom the visitor's IP, browser, your pixel id and the date.

The key matters more than the hash. Every other input is guessable — the date is obvious and the pixel id is public — so an unkeyed hash of an IP address could be brute-forced back into that address in minutes. Because ours is keyed with a secret only we hold, and rotates daily, it cannot be reversed or used to follow anyone across days or sites. Stored pageview records contain no IP address at all.

Visitor IP addresses are discarded, on a timer

Visitor Identification needs an IP address briefly to look up which company an address belongs to. Once resolved, the address is discarded.

Because “discarded once resolved” only covers addresses that actually get resolved, a separate scheduled sweep deletes any pending IP address after 9 days — unconditionally. It does not depend on your audit schedule, on the lookup succeeding, or on the feature being configured at all. It runs first, before any other scheduled work, so it cannot be crowded out by a long job ahead of it.

Contact data we deliberately do not keep

When we look up a company's public contact details, we keep only generic role addresses on that company's own domain — such as info@ or sales@. Addresses belonging to named individuals are discarded even when they are published on the page. This costs us the occasional legitimate team inbox with an unusual name; we think that is the right trade.

How we fetch pages

Audits fetch your publicly available pages with a clearly identified user agent (WebGrowthSignal-Bot) and reasonable rate limits. We do not attempt to access password-protected or private areas.

One fetch target is not chosen by you: the website of a company we have identified. That request goes through a stricter path that resolves the hostname, refuses private, loopback and internal-network addresses, and re-checks every redirect hop — so a hostile domain cannot use us to reach systems inside our own network.

Generated code runs in isolation

Website Builder output is AI-written code, so we treat it as untrusted. It is installed, compiled and previewed inside an isolated microVM sandbox — never in our application process. Each generated app that stores data gets its own database with its own credentials, so one app can never read another's. The only secret ever injected into a generated app is its own database URL; no WebGrowthSignal credential is exposed to it.

Sending on your behalf

Outreach is sent from a sending address you verify yourself, never from a shared one — so one sender's reputation cannot affect anyone else's. Every message passes a single consent check immediately before it is sent, not merely when it was scheduled, and unsubscribes, bounces and spam complaints suppress an address automatically. Unsubscribe links only take effect on a confirmed action, so a mail scanner that pre-fetches links cannot unsubscribe someone by accident.

Encryption and infrastructure

All traffic to and from the service is encrypted in transit using TLS. Data is stored in a managed PostgreSQL database. The application runs on Vercel and the database is hosted on Neon, both with their own security and compliance programs. Access to production systems is limited on a need-to-know basis, and secrets are held as environment configuration, never in source control.

Data minimisation

We collect only what is needed to run audits and deliver your action plan, and we send only minimal context to our AI providers — never visitor IP addresses, subscriber lists or contact details. You can delete a site or your whole account at any time, which removes the associated data.

Responsible disclosure

If you believe you've found a security vulnerability, please report it to security@webgrowthsignal.com. We appreciate responsible disclosure and will work with you to verify and address valid reports promptly. Please give us a reasonable amount of time to respond before any public disclosure.