What happens to your data when you audit a page
This is not a page of reassurances. It is a description of what our system actually does with the address you paste, written from the code that does it.
If you are weighing us up before submitting a client's URL, or you need something to forward to a security team, this is the page to send. It answers one question: what exactly do you keep about my site, why, and for how long?
What we do to the page you submit
One request — and it is the same request any visitor makes.
- We send a single HTTP GET to the address you submit and read what the site returns to the public: the response headers and the HTML. That is the entire interaction with your site.
- The analysis is passive. We do not log in, submit forms, inject payloads, try credentials, scan ports, or crawl other paths. Our request identifies itself in the user agent as SiteMeritBot.
- We analyse the page you submit, not the site around it. One URL, one report. Links found in the markup are read as data, never followed as new audits.
- If the address redirects, we follow it ourselves and re-resolve the destination at every hop, checking the IP address before connecting. That check keeps our engine from being pointed at a private network — a protection for you as much as for us.
What we store, record by record
Two records and a counter. This is the whole list.
| What it holds | How long we keep it | |
|---|---|---|
| The audit result | The URL you submitted, the language of the report, whether it is a paid report, the engine version, the timestamp, and the full result: every check with its verdict and the score. Paid reports also hold what was observed while the page executed in a browser — accessibility findings, the cookies and third-party domains seen during the initial load, and the execution signals matched against our technology signature catalog, with the catalog version — and the written guidance that was generated. | A free audit is created with an expiry stamp seven days out. A paid report carries no expiry. |
| The purchase | Written only when a payment completes: the audited address reduced to site and path, which modules were bought, the amount and currency, the e-mail address you entered at checkout, and the timestamp. Never your card details — those go to Stripe and never reach us. | No expiry is set on this record: it is the accounting record of the sale. |
| The rate-limit counter | A count of requests per hour, so that a single source cannot exhaust the service. Your IP address is not stored: it is reduced to an irreversible SHA-256 hash that serves as the counter's key. | The counter is stamped to expire two hours after the window it belongs to. |
The reason we store results at all is the very thing you paid for. A paid report lives at a permanent link you can return to, reload, and send to a client. Deleting the result would mean the deliverable does not survive closing the tab — so the persistence is not a slip we are confessing to, it is the feature.
Questions about your own data, including removal, go to privacy@sitemerit.com, which is the queue meant for exactly that.
What we never ask you for
You can run an audit without creating an account. There is no registration, no password, no login, and no profile of you. On a free audit, the only thing you hand over is the address you want checked. An e-mail address enters the picture at one moment only: when you pay, because Stripe's checkout collects it along with the payment.
Who else receives the data
We do not sell, rent, or trade data. Two companies do receive some of it, because the product cannot work otherwise — and it would be dishonest to leave them off this page.
- Stripe — processes the payment. You enter your card details on Stripe's own checkout, not on our site. We receive the confirmation and the e-mail you gave them; the card number never reaches us.
- Google — receives data at one moment. For the written guidance in paid reports: the findings of your audit are sent to Google for AI-assisted interpretation, and the text that comes back is stored with your report.
What we do not have
Stated here, before you have to ask for it.
- We are not SOC 2 certified, and we are not ISO 27001 certified.
- We have not been through a third-party penetration test.
- We do not run a bug bounty programme, and we do not pay for reports.
- We do not claim that your data is never stored. It is stored, and the sections above say where and for how long. Any audit tool that claims otherwise while handing you a permanent report link is describing something other than its own architecture.
- We do not certify anyone's compliance, our own included. Our reports detect signals of risk; that is not a certificate, and no automated tool can issue one.
What "security" means inside the report
So that the word is not left doing vague work, this is the exact list our engine looks at in the security category — eleven checks, every one of them read from the response your page already returns to the public:
- Strict-Transport-Security (HSTS)
- Content-Security-Policy (CSP)
- X-Frame-Options
- X-Content-Type-Options
- Referrer-Policy
- Permissions-Policy
- Secure flag on cookies
- Whether the page so much as mentions a privacy policy — a surface check on the HTML, not a review of what the policy says
- Server and technology details exposed in the headers
- CORS configuration
- Reverse tabnabbing on outbound links
All eleven are observations about a public response. None of them requires touching anything private, and none of them is a penetration test.
One of these eleven — the Content-Security-Policy check — is where our own site currently fails. Read our own audit record
Reporting a security problem
If you find a vulnerability in SiteMerit itself, write to security@sitemerit.com
- There is no guaranteed response window. We are a small team, and we would rather say so than publish a service level we cannot hold to — a 48-hour promise is the easiest sentence on this page to write and the hardest to keep.
- There is no bug bounty and no reward. We are not going to imply otherwise by staying quiet about it.
- What we do commit to is what a small team can actually deliver: we read everything that arrives at that address.
- And we will not set lawyers on anyone who reports a problem in good faith.
See what it reads on your own site
The free sample runs against the page you choose, with no account and nothing to cancel.
Start audit