Security

Sessions are signed with AUTH_SECRET. Passwords are hashed with bcrypt. Dashboard routes require authentication. Billing card data is handled by Stripe — ClientProof does not store PANs.

Report crawls only fetch public HTML from URLs you provide, capped at eight pages, with robots.txt respected. Crawl excerpts are stored with your lead record to generate the report.

Infrastructure

Production runs on Vercel with a managed PostgreSQL database. Uploads use S3-compatible object storage when configured. Secrets and API keys live in environment variables, not in the repository.

Subprocessors

Key vendors that process data on our behalf are listed on the privacy policy (hosting, database, payments, email, and optional object storage). We do not claim third-party certifications on your behalf; review each vendor's documentation for their compliance posture.

Report a vulnerability

Email security@useclientproof.com with a description, steps to reproduce, and impact. We read good-faith reports promptly. Do not include live customer data or secrets in your first message.

Incident response

When we confirm a security incident that affects customer data, we investigate scope, contain the issue, restore service, and notify affected account holders at the email on their agency profile when notification is required. Status updates go to the reporting contact and, when appropriate, to affected customers.

General product security questions can also go to support@useclientproof.com or the contact form.