Trust

Trust & Security

Effective November 2026

This page is for anyone assessing Decloak as a supplier. It sets out what we collect, where it lives, how we protect it, and where we are on formal certification. Decloak is operated by Sparrow Technology Ltd, a UK company. If something you need isn't here, email support@decloak.dev.

1. Certification status

Decloak does not currently hold ISO 27001 or SOC 2 certification. We would rather say that plainly than imply otherwise. Formal certification is on our roadmap, and we will update this page when that work starts.

In the meantime we are happy to complete supplier security questionnaires and answer questions in writing for your own risk assessment. Our Data Processing Addendum also gives you a contractual right to that information.

2. What a scan collects

A standard scan only collects what any visitor's browser receives when they load your site: page content, scripts, response headers, cookies the site sets, and the third-party requests it makes, plus public DNS and certificate records for the domain. We don't need access to your systems, source code or customer data, and we don't install anything.

A scan also checks whether a database or backend referenced in your site's public code (for example Supabase or Firebase) can be read by anyone. If it can, we record which tables or collections responded and their field names as evidence, with the values redacted. We don't keep the data itself.

Some optional features go further, and only run when you turn them on:

  • Authenticated scans use a login session you capture and send to us, so they can see pages behind your sign-in. The session is single-use and deleted after the scan, unless you link it to a scheduled scan, in which case it is encrypted at rest until you revoke it. See section 6 of our Privacy Policy.
  • Active Security Testing and AI Pentesting (Enterprise) send test requests to confirm vulnerabilities, and keep the evidence needed to show a finding is real.

For your own account we hold your email address, team and settings, and the scans and findings you run. Billing details are handled by Stripe; we never see full card numbers.

3. Where your data is hosted

Our database, including accounts, scans and findings, is hosted by Supabase in Ireland (AWS eu-west-1). The application and scan workers run on Render in the United States, and scanned pages are rendered by Browserless in the United States. Transfers outside the UK and EEA are covered by the safeguards in section 7 of the Data Processing Addendum.

Every third party we use, what it does and what data it receives is listed on our Subprocessors page.

4. Security measures

  • Encryption in transit (HTTPS/TLS) for all traffic to our API and between our services.
  • Database access controlled by authentication, team-based row-level security and role-based permissions. Service credentials are held as server-side secrets.
  • Passwordless sign-in by magic link or passkey, so there are no Decloak passwords to leak or reuse.
  • Captured login sessions are single-use, expire after 15 minutes, and are encrypted at rest where kept for a scheduled scan.
  • Scanner requests are blocked from reaching internal or private network addresses.
  • AI Pentesting tools run in isolated, temporary sandboxes, with outbound access limited to the target.
  • Rate limiting and abuse controls on the public API.
  • Access to production systems is limited to the people who need it.

These are the same commitments made in section 5 of our Data Processing Addendum.

5. Retention and deletion

Scans and findings are kept so you can see report history and compare results over time. You can delete a scan or your whole account at any time; the data is removed from active storage straight away and from backups within 7 days. Billing records are kept as required for tax and accounting. Full details are in section 7 of our Privacy Policy.

6. Incidents and vulnerability reports

If a personal data breach affects your data, we will tell you without undue delay, and within 72 hours where feasible, as set out in our Data Processing Addendum.

If you find a security issue in Decloak itself, please report it to support@decloak.dev. Our contact details are also published at /.well-known/security.txt.

7. Documents