Security & privacy
A plain-language description of how this service is built and how it handles your data. We keep this page factual — if something here is unclear, ask us at hello@zalize.com.
Architecture
- The website and API run as a Cloudflare Worker with static assets — there are no traditional servers to patch for the main application, and all traffic is served over HTTPS (TLS) via Cloudflare's edge network.
- Application data (accounts, sites, badge scan results, settings) is stored in Cloudflare Workers KV, a replicated key-value store operated by Cloudflare across its global network.
- The C2PA image-signing API runs on a separate hardened virtual server. Images sent for signing are processed in memory and returned; they are not retained after the request completes.
- Payments are handled entirely by Paddle (our merchant of record). We never see or store card numbers — we store only the Paddle customer/subscription identifiers needed to map a purchase to your account.
What we store
- Account: your email address, plan, API key and purchase status.
- Sites: the name, domain and badge configuration you enter, plus daily badge impression counters and weekly badge-scan results.
- Settings: optional report branding (logo, company name, colour) and an optional notification webhook URL, if you configure them.
- Compliance checker answers and generated reports are produced in your browser; we do not receive or store your questionnaire answers or PDFs.
- Rate-limiting and abuse prevention use a salted hash of the visitor IP address — we do not store raw IP addresses in application data.
What we don't do
- We do not sell or rent your data to anyone.
- We do not run third-party advertising or tracking scripts on this site.
- The disclosure badge script does not use cookies and does not fingerprint visitors; it reports a single anonymous impression ping (deduplicated via a salted IP hash) so you can see your badge is live.
- Passwords don't exist here — sign-in uses one-time magic links sent to your email, so there is no password database to breach.
Webhook & API safety
- Notification webhooks are restricted to known providers (hooks.slack.com, *.webhook.office.com, *.logic.azure.com, webhook.site) over HTTPS only — the server will not call arbitrary URLs (SSRF protection).
- API keys are scoped to your account and can be regenerated by contacting us; C2PA API usage is rate-limited and quota-enforced per plan.
- All API endpoints apply per-IP rate limits to mitigate abuse.
Your rights & contact
- You can ask us to delete your account and associated data at any time — email hello@zalize.com.
- Data processing is limited to running the service you signed up for. Where the GDPR applies, you have the usual rights of access, rectification and erasure.
- Found a vulnerability? Please report it to hello@zalize.com — we appreciate responsible disclosure and will respond promptly.
Related: how the compliance checker works · infrastructure providers: Cloudflare Trust Hub and Paddle privacy policy.