Skip to content
PixelPrivate
Log inFree trial
Menu
Attack Surface & ExposureEmail & Brand ProtectionData ExposureTrust & CompliancePolicy & AccessPlatform overviewCEOs of growing companiesCFOs and finance leadersManufacturingSaaSE-commerceHealthcare and clinicsProfessional servicesAgencies and MSPsCyber-insurance readinessReal casesScenariosFree toolsLearnPricingLog inStart 14-day free trial

Trust

Trust center

What we do with your data, how we protect it, and what we deliberately do not claim.

Certifications

PixelPrivate does not currently hold SOC 2, ISO 27001 or any other security certification, and we make no claim of GDPR certification. If that changes, it will be stated here with evidence.

Data we handle

  • Account email and organization membership.
  • Domains you save and the results of scans of those domains.
  • Anonymous free-scan results, kept for a short period (default 24 hours) and then deleted.
  • Abuse-control data: salted hashes of IP addresses, not raw IPs.
  • Evidence about third-party lookalike sites (DNS, certificate, signals), kept for a limited period (default 90 days).

Data we do not collect

PixelPrivate does not ask for or store passwords of the services it assesses, and does not read your email or access your internal systems.

Safeguards

  • Tenant isolation enforced server-side and by database row-level security.
  • Secrets only in server environment variables.
  • TLS everywhere; secure, HttpOnly cookies; security headers.
  • Rate limiting and bot protection on anonymous endpoints.
  • Audit logging for account and domain changes.

AI

AI, when enabled, receives only the structured findings of the scan being discussed. It does not create findings. Deterministic templates are used when AI is off. See methodology.

Subprocessors

Depending on how PixelPrivate is deployed: a PostgreSQL database host (for example Neon), an authentication provider (Clerk, which holds sign-in credentials; PixelPrivate never stores passwords), a hosting provider, a bot-protection provider (Cloudflare Turnstile), a payment provider acting as merchant of record (card details are handled by that provider, never by PixelPrivate), a transactional email provider and, optionally, an AI model provider. The operator must keep this list current in the privacy policy.

Documents