Security

Your reports describe your product's weaknesses, so we keep this simple and strict.

Your data

• Every workspace is separated at the query level, and automated tests check that separation.
• Passwords are hashed. Share passcodes are hashed.
• Share links use long random tokens, and you can revoke them at any time.
• View counts use a salted daily hash. We do not store visitors' IP addresses.
• Signed reports are frozen, and each carries a SHA-256 hash.

The free Reviewer Check

Your file is read in memory and is never stored.

The scanner

The scanner visits only public addresses. It refuses private networks, including on redirects, and it never asks for your passwords. For pages behind a login, you run axe yourself and import the results.

What we do not have

GoodACR does not hold a SOC 2 report or an ISO 27001 certificate.

Report a vulnerability

Email support@goodacr.com.