Trust & Security
How AllyProof protects your data and maintains operational security.
Last updated: July 9, 2026
Hosting and Data Region
AllyProof infrastructure is hosted in the European Union. Our primary application servers run in ISO 27001-certified data centers in Germany.
Database services run on a managed PostgreSQL platform with data stored in EU-based instances. All data at rest remains within the EU unless you explicitly configure otherwise.
Static assets and edge caching are served via a global CDN with points of presence worldwide.
Encryption and Transport Security
- In transit: All connections use TLS 1.2 or higher, with automatic certificate renewal at the edge. HTTP Strict Transport Security (HSTS) is enforced.
- At rest: Database storage is encrypted using AES-256. Backups are encrypted before transfer to storage.
- API keys: Stored as SHA-256 hashes. The original key value is shown once at creation and never stored.
- Passwords: Hashed using bcrypt by our managed authentication provider. We never store plaintext passwords.
Authentication and Session Security
- Authentication uses a PKCE (Proof Key for Code Exchange) OAuth flow via our managed authentication provider.
- Email/password and Google OAuth sign-in are supported.
- Sessions are managed via secure, HttpOnly cookies with automatic refresh.
- Row Level Security (RLS) policies enforce multi-tenant data isolation at the database level — users can only access data belonging to their organization.
- Role-based access control (RBAC) with three levels: Owner, Admin, Member. All restricted actions are enforced server-side.
Data Retention and Deletion
- Account data: Retained for 30 days after account deletion request, then permanently removed.
- Scan results: Retained as long as the site exists in your organization. Deleted within 30 days of site removal.
- Activity logs: Retained for 90 days, then automatically purged.
- AI processing: Violation data sent to our AI provider for fix suggestions is not retained by the provider or used for model training. We do not send full page content — only violation metadata and HTML snippets.
Backup and Disaster Recovery
- Database backups: Automated daily backups with point-in-time recovery capability.
- Report storage: Scan reports and VPAT documents are stored in EU object storage with cross-region redundancy.
- Recovery time objective (RTO): Under 4 hours for full service restoration.
- Recovery point objective (RPO): Under 24 hours (daily backup interval).
Vulnerability Disclosure / Security Contact
If you discover a security vulnerability in AllyProof, please report it responsibly:
- Email: security@allyproof.com
- Please include a description of the vulnerability, steps to reproduce, and any relevant screenshots or logs.
- We will acknowledge receipt within 48 hours and provide an initial assessment within 5 business days.
- We do not pursue legal action against security researchers who act in good faith.
Incident Response Contact
For active security incidents or data breach notifications:
Accessibility Testing Limitations
AllyProof uses automated scanning tools (axe-core, HTML_CodeSniffer) to detect accessibility issues. It is important to understand the limitations of automated testing:
- Automated testing covers only part of accessibility conformance. Industry estimates suggest automated tools can detect approximately 30-57% of WCAG success criteria violations.
- Automated scans cannot evaluate subjective criteria such as whether alt text is meaningful, whether content order is logical, or whether a user experience is truly accessible.
- A clean automated scan does not guarantee full WCAG conformance. Manual expert testing, assistive technology testing, and user testing are also necessary.
- VPAT documents generated by AllyProof are labeled DRAFT and must be reviewed by a qualified accessibility professional before being used for procurement or compliance purposes.
- AllyProof does not provide legal advice. Scan results should not be interpreted as a legal compliance assessment.
Browser Extension
- Local-first by default:Quick-scans run entirely in the user's browser (axe-core executes in the page context). Results live in
chrome.storage on the device and are not transmitted to AllyProof unless the user signs in and explicitly saves them. - Minimum permission surface:
activeTab, storage, sidePanel. The manifest does not request <all_urls>; the extension cannot read background tabs or browsing history. - Token storage model: Access tokens live in
chrome.storage.session (cleared on browser restart); refresh tokens live in chrome.storage.local. chrome.storage.syncis never used — tokens never propagate across the user's other Chrome devices. - No remote code execution: The extension does not load scripts from the network. All bundled JavaScript ships in the store-signed package and is reviewed by the respective store before delivery.
- No third-party tracking: No analytics SDK, no advertising scripts, no telemetry by default. An optional opt-in telemetry switch is disabled out of the box.
- Update channels: Chrome Web Store, Microsoft Edge Add-ons, Firefox Add-ons. Updates are signed by the respective store.
Sub-Processors
AllyProof uses a small number of vetted third-party providers to deliver the product: an EU database & authentication platform, an EU cloud infrastructure provider (Germany), a global CDN & security provider, a payment provider (Paddle.com Market Limited, our Merchant of Record), a US-based AI language-model provider (zero-retention API terms), and a US-based transactional email provider.
A complete, current list of sub-processors with vendor names and data processing terms is available on request at legal@allyproof.com. Customers with a Data Processing Agreement are notified of material sub-processor changes in advance.