Our security program
SitePath Intelligence LLC treats the security of our platform and the confidentiality of customer data as core to the product. This page summarizes the controls we operate and how to responsibly report a security issue.
How we protect data
- Encryption in transit. All traffic is served over HTTPS/TLS. We enforce HTTP Strict Transport Security (HSTS) with preload and redirect insecure requests.
- Hardened browser policy. We ship a strict Content-Security-Policy,
X-Frame-Options: DENY, X-Content-Type-Options: nosniff, a restrictive Permissions-Policy, and cross-origin isolation headers to reduce the risk of injection, clickjacking, and data leakage.
- Server-side access control. Every request for paid data is authenticated and authorized on the server against the user's plan and entitlements — the paywall is never enforced by the browser alone.
- Least-privilege data store. Our database enforces row-level security and is reachable only by trusted server-side functions, not directly from the public internet.
- Payment isolation. Card data is handled entirely by Stripe (a PCI-DSS Level 1 provider) and never reaches our servers.
- Secret hygiene. Credentials are kept out of source control and enforced by pre-commit and continuous-integration secret scanning.
- Data durability. Our records are versioned and change-logged, and source data is retained append-only so history is not silently lost.
For the list of third-party subprocessors that may process personal data on our behalf, and the safeguards governing international transfers, see our Data Processing Addendum (Schedule 3) and Privacy Policy.
Coordinated vulnerability disclosure
We welcome reports from security researchers and will work with you in good faith to verify and remediate legitimate issues.
How to report
- Email: support@sitepathintel.com with the subject line "Security Report".
- Include a clear description, the affected URL or endpoint, reproduction steps, and any proof-of-concept. Please give us a reasonable time to remediate before any public disclosure.
- Our machine-readable contact is published at /.well-known/security.txt (RFC 9116).
Please do
- Test only against your own account and data.
- Stop as soon as you confirm a vulnerability, and report it promptly.
- Keep details confidential until we have released a fix.
Please do not
- Access, modify, or delete data that is not yours.
- Run denial-of-service, spam, social-engineering, or physical attacks.
- Degrade the experience for other users.
Safe harbor
If you make a good-faith effort to comply with this policy during your research, we will consider your testing authorized, will not pursue or support legal action against you for it, and will work with you to understand and resolve the issue quickly. This policy does not authorize actions that violate applicable law.
We do not currently operate a paid bug-bounty program, but we are glad to acknowledge researchers who responsibly disclose valid issues.
Reporting a data incident
If you believe your account or personal data has been compromised, email support@sitepathintel.com immediately with the subject line "Security Report". Our breach-notification commitments to customers are described in our Data Processing Addendum.