Serious about security.
Built for procurement.
Everything your security, legal, and procurement teams will ask about, answered up front — no sales call required to read the fine print. When you are ready, support@maskbreak.com goes straight to the founder.
What your security and legal teams will ask
GDPR & CCPA
Aligned to UK/EU GDPR and CCPA; not independently certified. We operate as a data processor for end-user evaluation — Art. 28 DPA self-serve at maskbreak.com/dpa, with 30 days’ notice in the dated change log at maskbreak.com/sub-processors before we add or replace a sub-processor that processes customer end-user data (DPA §6).
Privacy policy →GDPR-aligned processing
Application hosting and the primary database run in the United States (US East) and our detection providers are US-based; encrypted backups are stored in the EU (Stockholm). EU-only processing is not available today; transfers are covered by Standard Contractual Clauses under the DPA (see our sub-processor list for each region). End-user analysis runs on network and device metadata — no names or payment data; an optional email is checked in memory for a disposable domain and never stored.
Trust & security →Minimal retention
Evaluation IPs are replaced with a keyed one-way hash after 7 days. Passwords travel over TLS, are stored only as bcrypt hashes, and are breach-checked by sending only a 5-character SHA-1 prefix to Have I Been Pwned.
Retention details →Hardened by default
TOTP two-factor authentication, active session management with per-device revocation, and breach-checked password policies on every account.
Security overview →Measured, not promised
Processing time reported on every evaluation, measured figures on a public status page, published service level objectives, and transparent rate limits — no silent throttling, Retry-After on every 429.
Paperwork, handled
Enterprise agreements, custom MSAs, security questionnaires (CAIQ / SIG Lite), and vendor-onboarding forms are handled directly by the founder — typical turnaround is days, not quarters.
support@maskbreak.com →The paperwork, up front
What we can put in front of your legal and security teams today:
| Document | Status | How to get it |
|---|---|---|
| Data Processing Agreement (Art. 28) | Published | maskbreak.com/dpa — self-serve, with a PDF for vendor files; countersigned copy via support@maskbreak.com |
| Master Service Agreement / custom terms | Available | Negotiated directly with the founder |
| Service level objectives | Published | maskbreak.com/sla — contractual SLA with credits under enterprise MSA |
| Security whitepaper | Published | maskbreak.com/security-whitepaper — self-serve, with a PDF for vendor files |
| Sub-processor list | Published | maskbreak.com/sub-processors — regions and a dated change log, where new customer-data sub-processors are announced 30 days in advance; network & device-intel providers named under DPA |
| Security questionnaires (CAIQ, SIG Lite, custom) | Available | Send yours to support@maskbreak.com |
| SOC 2 Type II report | Pre-audit | We publish the audit firm and scope when the engagement is signed — see Trust |
Billing: Enterprise starts at €990 a month, with custom volume, an SLA and a signed DPA — contact sales. The self-serve plans are Free, Starter €29, Growth €99 and Scale €299 a month (see pricing), and every plan runs the same checks. Billing and invoices are handled by Stripe; prices exclude VAT.
The Enterprise plan
Evaluating Maskbreak for an enterprise platform? Start on the Free plan (10,000 visitor checks a month, no card) with production traffic and every check. When you need more than Scale’s 1,000,000 checks a month, an SLA or a signed DPA, Enterprise starts at €990 a month with custom volume — tell us what you're working on.
A hospital, public body, election office, university or registered non-profit rather than a company? The public-interest program removes the cap entirely, with institutional email domains fast-tracked.