How Maskbreak handles security and data.
One row for each topic, with the document that states it in full. Maskbreak is a small company run by its founder, and it holds no security certification yet.
How data is handled
| What we process | For each check: the visitor’s IP address, network signals, and browser and device signals, plus any email address, phone number or account ID your server sends. We process it for you under the Data Processing Agreement; the one record we keep as our own is a hashed device’s visit count across customers, with no site or account attached. |
| Where it runs | Our server and database run on Cloudflare in the United States (Eastern North America). The nightly backup goes to Cloudflare R2 in its EU jurisdiction; since 22 October 2026 there is also a second copy of the nightly database backup in Google Drive, encrypted with a key only we hold. EU-only processing is not available today. |
| Sub-processors | Every provider is on the sub-processor list with its region, and every former one with what it may still hold. A new sub-processor of customer data is announced in the list’s change log at least 30 days ahead, with the right to object (DPA Section 6). |
| Retention | IP addresses in stored evaluation records and false-positive reports are hashed after 7 days with a keyed one-way hash, and the hashes are still pseudonymous personal data. Application logs are kept by Cloudflare for 7 days, and since 22 October 2026 a copy for 30 days in Cloudflare R2 (EU jurisdiction), with keys and tokens removed first. Other records follow the Privacy Policy’s retention rules. |
| Account deletion | Self-service on the console’s Security page, with live-system deletion at once. Backups keep to the 60-day backup-retention commitment: a daily audit checks the backup expiry rule, and restoring a backup stays blocked until post-restore deletion is verified. Copies made up to 16 October 2026 sit in our former AWS backup account, now suspended, where a 60-day expiry rule was set, but we can no longer check or delete them ourselves. |
| Analytics and error reports | PostHog (EU) records page views, clicks and session recordings on public pages, sign-up and the dashboard, without a consent prompt. Form fields, the visitor’s network readouts and dashboard text are masked first, and browsers sending Global Privacy Control or Do Not Track are skipped (Cookie Policy). Sentry (EU) receives server errors only, with personal data removed by pattern: a strong safeguard, not a guarantee. |
How the service is secured
| Encryption | TLS 1.2 or later on every connection. Cloudflare D1 encrypts the database at rest and R2 the backups, and account IDs your server sends are encrypted in the database too (AES-256-GCM, a key per customer). Every control is in the security whitepaper. |
| Web pages | HSTS and a Content Security Policy on every page, enforced without inline script on the console and the admin. |
| Sign-in | Passwords are stored as bcrypt hashes and checked against Have I Been Pwned by a 5-character hash prefix. Two-factor codes and passkeys are available, and 10 wrong passwords in 30 minutes lock sign-in. The console session is an HttpOnly cookie, and the Security page lists every session with per-device sign-out. |
| Admin access | The internal admin console signs in only through single sign-on with a passkey, behind Cloudflare Access, which admits only the owner. Every admin request is kept in an audit table for a year, and a key rotation, two-factor removal or sign-out an operator makes on your account is emailed to you. |
| Vulnerability reports | Write to support@maskbreak.com (security.txt); the disclosure policy sets the scope and the safe harbour. There is no bug bounty and no reward of any kind. |
| Certifications | None yet: SOC 2 Type II pre-audit, ISO 27001 not yet, HIPAA BAA not yet, PCI DSS not yet. No third-party penetration test has been commissioned yet. We will publish the audit firm and scope when an engagement is signed. |
| Service levels | The status page shows probe results and incidents. The service level aims are not guarantees; contractual service levels come only in a signed agreement (Enterprise). |
A security questionnaire, a countersigned DPA or anything not on this page: write to support@maskbreak.com.