Security

Authentication

You can sign in with Google, with an email address and password, or with a one-time link sent to your email. We never see your Google password. Passwords we do handle are stored only as a salted scrypt hash, which is deliberately slow to compute and cannot be reversed. Sessions are signed tokens tied to your account, and every page of the application checks them server-side.

Payments

Card details are entered directly into Razorpay's checkout and never reach our servers — we hold no card numbers to lose. Every payment we act on is verified twice: the result returned to your browser carries a cryptographic signature we check, and we then re-read the authoritative status from Razorpay before granting anything. Our payment webhook is signature-verified and refuses to run at all if its signing secret is missing, rather than falling back to trusting whatever it receives.

Cookieless, first-party analytics

Traffic Intelligence and Heatmaps run on our own lightweight pixel — not Google Analytics. It sets no cookies and does no cross-site tracking. To count unique visitors we derive a keyed one-way hashfrom the visitor's IP, browser, your pixel id and the date.

The key matters more than the hash. Every other input is guessable — the date is obvious and the pixel id is public — so an unkeyed hash of an IP address could be brute-forced back into that address in minutes. Because ours is keyed with a secret only we hold, and rotates daily, it cannot be reversed or used to follow anyone across days or sites. Stored pageview records contain no IP address at all.

How we fetch pages

Audits fetch your publicly available pages with a clearly identified user agent (WebGrowthSignal-Bot) and reasonable rate limits. We do not attempt to access password-protected or private areas.

Sending on your behalf

Outreach is sent from a sending address you verify yourself, never from a shared one — so one sender's reputation cannot affect anyone else's. Every message passes a single consent check immediately before it is sent, not merely when it was scheduled, and unsubscribes, bounces and spam complaints suppress an address automatically. Unsubscribe links only take effect on a confirmed action, so a mail scanner that pre-fetches links cannot unsubscribe someone by accident.

Encryption and infrastructure

All traffic to and from the service is encrypted in transit using TLS. Data is stored in a managed PostgreSQL database. The application runs on Vercel and the database is hosted on Neon, both with their own security and compliance programs. Access to production systems is limited on a need-to-know basis, and secrets are held as environment configuration, never in source control.

Data minimisation

We collect only what is needed to run audits and report what they found, and we send only minimal context to our AI providers — never a visitor IP address, because we never store one. You can delete a site or your whole account at any time, which removes the associated data.

Responsible disclosure

If you believe you've found a security vulnerability, please report it to security@webgrowthsignal.com. We appreciate responsible disclosure and will work with you to verify and address valid reports promptly. Please give us a reasonable amount of time to respond before any public disclosure.