Built to be reviewed.
Documented to be approved.
Everything an enterprise security, legal, or procurement team needs to assess Maskbreak — in one place. We are a young, small company and we are honest about what that means: real DPA, real sub-processor list, real vulnerability disclosure policy, and an explicit statement of what compliance attestations we do not yet hold.
Data we process & why
Network metadata (IP, ASN, proxy/VPN signals) and device telemetry (browser fingerprint, tampering, automation and private-browsing indicators) processed under GDPR Art. 6(1)(f) legitimate interest. Raw IPs in stored evaluation records and false-positive reports are one-way hashed after 7 days; those hashes remain pseudonymous personal data. Other records follow the retention rules in the Privacy Policy.
Privacy Policy →Who we share data with
Network-intelligence and device-intelligence providers (United States; named to customers under DPA), Cloudflare (CDN; the application host since 20 October 2026; email delivery and the primary database, D1 in the United States, since 19 October 2026, including keyed abuse-prevention counters), Railway (the host until 20 October 2026, now a stand-by copy without traffic, United States), Turso (the database until 19 October 2026; deleted with our account the same night), PostHog (product analytics and session recordings on public pages, sign-up and the dashboard, EU Cloud), Sentry (server error reports, EU region, with personal data removed by pattern-based scrubbing before sending), Widgo and Crisp (former chat providers, legacy support records only), Cloudflare R2 (encrypted backups, EU jurisdiction, since 17 October 2026), Amazon Web Services / S3 (the backup copies made up to 16 October 2026, EU), Google (Sign-In, including One Tap on /login) & GitHub (Sign-In, plus GitHub Actions for monitoring and the nightly database backup job), Have I Been Pwned (k-anonymity password check), flagcdn.com (flag images in the console’s test panel), Stripe (payments and invoices for paid plans; account holders’ billing data only). Regions and a dated change log are on the public list; new customer-data sub-processors are announced in that change log at least 30 days in advance.
Fonts are self-hosted. Google Ads tags and conversion-event calls were removed on 6 September 2026; Google Sign-In is separate. See Cookie Policy §2.3.
Sub-processor list →Report a vulnerability
Scope, response targets, safe-harbour commitments under UK CMA / US CFAA / EU Cybercrime Directive. No bug bounty or other rewards; contact methods documented. RFC 9116 /.well-known/security.txt served.
Click-through & MSA
Standard click-through Terms cover most usage. MSA available for procurement that can't accept click-through. DPA aligned to UK/EU GDPR Art. 28 with Standard Contractual Clauses — self-serve at /dpa, countersigned copy on request.
Terms of Service →Uptime & incidents
Best-effort 99.9% uptime target on the Free plan and the self-serve paid plans. Real-time status and incident history. An executed enterprise agreement turns the published objectives into a contractual SLA with service credits and defined incident-response times.
Status page →What we set in your browser
Your sign-in token and selected preferences use localStorage; tab-specific state uses sessionStorage. The server stores a token hash, account identifier, IP address and user agent in a session record for authentication and revocation. Redirect sign-in also uses short-lived Secure, HttpOnly cookies to bind the callback to your browser.
There is no chat widget on our pages: the Widgo chat that loaded on public marketing pages from 22 September 2026 was removed on 30 September 2026, and our Content Security Policy no longer allows its hosts. Support is by email at support@maskbreak.com. Identifiers Widgo stored before the removal, and the records it already holds, are described in Cookie Policy §2.4.
Since 23 September 2026 PostHog product analytics records page views, clicks and sessions on public pages, /signup and the dashboard, from page load and without a consent prompt. Form fields, the visitor’s own IP and network readouts and all dashboard text are masked in the browser before anything is sent; sign-in, reset, verification, invitation, settings, security, members and admin pages never load it, and browsers sending Global Privacy Control or Do Not Track, or asking to save data, are not measured. The library is served from maskbreak.com, so PostHog receives data but cannot run code on our pages. See Cookie Policy §2.5.
Security controls in place today
Honest snapshot. Some are standard, some go beyond what most early-stage products do — we will not list ones we don't have.
| Control | Implementation |
|---|---|
| Authentication | Email + bcrypt-hashed password (new passwords over 72 bytes are refused), Google OAuth (RS256 JWKS verified), GitHub OAuth, TOTP 2FA with recovery codes and a per-account daily limit on wrong codes, passkeys (WebAuthn), a reviewable list of active sessions with per-device revocation, account lockout on repeated failures (re-authentication prompts share the same lock), and an email to the account holder when a correct password is followed by wrong two-factor codes. |
| API key generation | crypto.randomBytes; key prefix sk_live_; rotation supported via dashboard. |
| Password breach check | Have I Been Pwned k-anonymity (5-char SHA-1 prefix only) on signup and password reset. |
| Transport security | TLS 1.2+; HSTS (one year, includeSubDomains, preload directive — not yet on browsers’ preload lists); CORP same-origin; CSP with allowlists on every page (a strict first-party policy without inline script is enforced on the admin console and the customer console); X-Content-Type-Options nosniff; X-Frame-Options DENY; Permissions-Policy (camera/mic/geo/payment off). |
| Rate limiting | Per-account monthly allowances and hourly caps set by the plan (1,000/hr on the Free plan), shared by the live key and its predecessor during a key rotation, and a per-source-IP (200,000/hr) cap on the evaluate and lookup endpoints. Fixed-window rate limits on auth endpoints (IPv6 addresses also counted per /64), per-account limits on signed-in console and API routes, and a 30-minute lockout after 10 failed password attempts. Every 429 response carries Retry-After. |
| Admin access | Internal admin console behind Google sign-in for an allowlisted account or an admin key, under an enforced Content-Security-Policy without inline script. Every admin request is written to the application log (operator, route, account, outcome, operator IP); key rotations, two-factor removal, forced sign-outs and reinstatements made by an operator are emailed to the customer, and admin sign-ins and lockouts alert the owner. |
| CSP violation reporting | Live /api/csp-report endpoint capturing browser-side policy breaches. |
| Account deletion | GDPR Art. 17 — self-service deletion on the console’s Security page with password re-auth and live-system deletion. The 60-day backup-retention commitment remains unchanged; a daily audit checks the backup expiry rule and that no backup is older than 60 days (it has done so since 10 October 2026; the copies made up to 16 October 2026 are in our former backup store, whose account is suspended: a rule set to delete them within 60 days was in place, but we can no longer check or delete them ourselves), and restoring a backup stays blocked until post-restore deletion is verified. See the retention-assurance note. |
| Session invalidation | Changing your password, resetting it, or an admin suspension immediately invalidates all existing sessions (token-epoch bump); key rotation and password change require re-authentication. |
| Encryption at rest | Cloudflare D1 encrypts the database at rest (Turso’s managed encryption before 19 October 2026). API keys are generated with crypto.randomBytes, shown to you in your dashboard, and can be rotated or revoked instantly if exposed. |
| Error monitoring | Since 24 September 2026, unexpected server errors are reported to Sentry (EU region, Frankfurt): errors only, with no performance tracing, profiling, log forwarding or browser SDK. Request headers, cookies, bodies, query strings, IP addresses, email addresses, API keys, secrets and tokens are removed on our server before a report is sent, including from error messages; request paths keep a placeholder such as /v1/lookup/:ip, and outgoing calls keep only method, status and origin (a customer’s webhook host name can appear). The removal is pattern-based: a strong safeguard, not a guarantee. Sentry’s own IP-address storage and its generative AI features are turned off. |
| Logging & retention | Raw IPs in stored evaluation records and false-positive reports are hashed after 7 days, with a keyed, per-customer hash since 28 September 2026 (records hashed before then used an earlier, unkeyed hash; the same cleanup re-keys them with the secret key, and backup copies made before that keep the older form until they expire after 60 days); hashes remain pseudonymous personal data. Application logs are kept by our hosting provider for up to 30 days. Other records follow the Privacy Policy retention rules. Backup assurance limitations are noted above. |
For procurement teams
Self-serve, no email required: the security whitepaper, the Data Processing Agreement, and the sub-processor list with dated change log. Everything else below is available on request from support@maskbreak.com:
| Document | Notes |
|---|---|
| Data Processing Agreement (DPA) | Self-serve — UK GDPR / EU GDPR Article 28 aligned, binds on acceptance with no signature required. Standard Contractual Clauses / UK IDTA for international transfers and a countersigned copy available on request. |
| Master Services Agreement (MSA) | For customers who can't accept the click-through Terms. |
| Security questionnaires (SIG-Lite, CAIQ, bespoke) | Completed for your review within 5 business days of request; complex ones can be co-walked on a video call. |
| Penetration testing status | No third-party penetration test has been commissioned yet — we say so rather than imply otherwise. A responsible-disclosure program is active (see security.txt); this row will be updated when a pen-test is completed. |
| Sub-processor change notices | A dated entry in the change log on /sub-processors at least 30 days before we add or replace a sub-processor that processes customer data, with right to object. |