Security

This page describes how CrawlBit protects the data you put in it. CrawlBit is operated by MindoLabs LLC, a limited liability company registered in Wyoming, United States. Every statement here describes the product as it runs today. Where a control does not exist, this page says so.

1. What CrawlBit holds about you

An account holds your email address, a password hash, the sites you audit, and the results of those audits. If you use the agency features, it also holds the names and domains of the clients you add, and the branding you set for their reports.

Client names and domains are the most sensitive data in the system, because they are your commercial information rather than ours. They are readable only by the account that created them.

2. Encryption

All traffic runs over HTTPS. The service sends HTTP Strict Transport Security with a one-year lifetime, so a browser that has seen the site once refuses to connect over plain HTTP.

Data at rest sits on encrypted disks at Render, our hosting provider, and their daily snapshots are encrypted too. Application-level encryption of individual database fields is not in place.

3. Passwords and sessions

Passwords are hashed with scrypt and a random per-account salt. The plaintext is never stored and never logged. Hash comparison runs in constant time.

A session expires 7 days after sign-in. The window is absolute: signing in again starts a new session, and using the product every day does not extend an existing one. The session cookie is HttpOnly, Secure, and carries the __Host- prefix, so a script cannot read it and a browser sends it only over HTTPS to this exact host.

Google sign-in uses the authorization code flow, with the authorization code exchanged server to server.

4. Separation between accounts

Every record that belongs to an account carries that account's identifier, and every route that reads a record by its identifier checks the owner before returning it. Automated tests cover this for monitored sites, tracked prompts, and agency clients.

Database queries use bound parameters throughout, so a value you type cannot change the shape of a query. The server runs no shell commands.

5. Shared client reports

A white-label report is served from a link containing a 96-bit random token. The link is not listed anywhere, and robots.txt excludes it from indexing.

Two limits are worth knowing before you send one to a client. The link does not expire, and there is no way to revoke a single link short of deleting the account. Anyone holding the link can open the report. Treat it as you would treat a shared document link.

6. Payments

Card details never reach CrawlBit. Checkout runs on Stripe, and the service stores only the Stripe customer identifier and what was bought. Incoming payment notifications are verified against a signature before they are applied; a notification that cannot be verified is refused rather than accepted.

7. Sub-processors

These providers process data on our behalf:

• Render (United States) hosts the application and its database.
• Cloudflare (United States) provides DNS for our domain and routes incoming email to our support address. TLS is terminated by our host.
• Stripe (United States) processes payments.
• Resend (United States) sends transactional email and reports.
• Anthropic, OpenAI, Perplexity and Google answer the questions used to measure citation. They receive the questions and the domain being measured.

Answer engines receive a domain name and a question. They do not receive your account email, your client list, or any other account data.

8. Keeping and deleting data

You can export your account data and delete your account from the settings screen, without asking us.

Deleting an account removes the account record, its sessions, its monitored sites, its tracked prompts, its alerts, its audits, its citation results, its agency clients, its shared report links, its saved reports, and any marketing contact captured under the same address. Lines carrying your address are removed from the server usage log as well.

One record survives deletion: a completed purchase. A sale is an accounting document, and the GDPR allows keeping data needed to meet a legal obligation. It holds the checkout identifier, the address that paid, and what was bought.

9. Backups

Render snapshots the disk daily, and snapshots are kept for at least seven days. Restoring a snapshot restores the whole database, so it is a recovery mechanism rather than a per-account one.

10. Reporting a vulnerability

Send it to support@crawlbit.app. The address is also published in security.txt. Tell us what you found and how to reproduce it. We do not run a paid bounty program.

11. What this page does not claim

CrawlBit holds no security certification. There is no SOC 2 report and no ISO 27001 certificate, and this page is not an audit by a third party. MindoLabs LLC is one person, so there is no separate security team and no on-call rotation.

The service ran its first full security review on September 14, 2026. It found five defects, all of them fixed and deployed the same day. Two were in documents the product sends out, one allowed a third party to unsubscribe an account they did not own, one allowed an unsafe link scheme in a shared report, and one concerned how third-party page content was passed to answer engines.

If you need a signed data processing agreement or a non-disclosure agreement before sending client data, ask at support@crawlbit.app.