Built to be reviewed.
Documented to be approved.
Everything an enterprise security, legal, or procurement team needs to assess Maskbreak — in one place. We are in open beta and we are honest about what that means: real DPA, real sub-processor list, real vulnerability disclosure policy, and an explicit statement of what compliance attestations we do not yet hold.
Data we process & why
Network metadata (IP, ASN, proxy/VPN signals) and device telemetry (browser fingerprint, tampering, behavioural signals) processed under GDPR Art. 6(1)(f) legitimate interest. Raw IPs in stored evaluation records and false-positive reports are one-way hashed after 7 days; those hashes remain pseudonymous personal data. Other records follow the retention rules in the Privacy Policy.
Privacy Policy →Who we share data with
Network-intelligence and device-intelligence providers (named to customers under DPA), Cloudflare (CDN), Railway (host), Turso (DB, including keyed abuse-prevention counters), Resend (email), Auth0 (emailed sign-in link, where offered), Widgo (optional public-page AI chat and visitor analytics after consent), Crisp (legacy support records only), Amazon Web Services / S3 (encrypted backups), Google (Sign-In only) & GitHub (Sign-In only, where enabled and offered), Have I Been Pwned (k-anonymity password check). Dated change log with 30-day notice for new customer-data sub-processors on the public list.
Fonts are self-hosted. Google Ads tags and conversion-event calls were removed on 6 September 2026; Google Sign-In is separate. See Cookie Policy §2.3.
Sub-processor list →Report a vulnerability
Scope, response targets, safe-harbour commitments under UK CMA / US CFAA / EU Cybercrime Directive. Bounty stance and contact methods documented. RFC 9116 /.well-known/security.txt served.
Click-through & MSA
Standard click-through Terms cover most usage. MSA available for procurement that can't accept click-through. DPA aligned to UK/EU GDPR Art. 28 with Standard Contractual Clauses — self-serve at /dpa, countersigned copy on request.
Terms of Service →Uptime & incidents
Best-effort 99.9% uptime target during beta. Real-time status and incident history. An executed enterprise agreement turns the published objectives into a contractual SLA with service credits and defined incident-response times.
Status page →What we set in your browser
Your sign-in token and selected preferences use localStorage; tab-specific state uses sessionStorage. The server stores a token hash, account identifier, IP address and user agent in a session record for authentication and revocation. Redirect sign-in also uses short-lived Secure, HttpOnly cookies to bind the callback to your browser.
Optional Widgo chat on eligible public marketing pages loads only after explicit consent on each page (“Enable AI chat”). Widgo uses cookies, browser identifiers and visitor analytics after consent. Session replay is disabled; no Widgo on sign-in or private account pages. “Disable AI chat” reloads without Widgo but does not erase existing storage or transcripts; email support remains available. See Cookie Policy §2.4.
Cookie Policy →Security controls in place today
Honest snapshot. Some are standard, some go beyond what most beta-stage products do — we will not list ones we don't have.
| Control | Implementation |
|---|---|
| Authentication | Email + bcrypt-hashed password, Google OAuth (RS256 JWKS verified), GitHub OAuth where enabled and offered, TOTP 2FA with recovery codes, passkeys (WebAuthn), a reviewable list of active sessions with per-device revocation, account lockout on repeated failures. |
| API key generation | crypto.randomBytes; key prefix sk_live_; rotation supported via dashboard. |
| Password breach check | Have I Been Pwned k-anonymity (5-char SHA-1 prefix only) on signup and password reset. |
| Transport security | TLS 1.2+; HSTS preload; CORP same-origin; CSP with allowlists; X-Content-Type-Options nosniff; X-Frame-Options DENY; Permissions-Policy (camera/mic/geo/payment off). |
| Rate limiting | Per-API-key (1,000/hr) and per-source-IP (50,000/hr) caps on the evaluate endpoint. Fixed-window rate limits on auth endpoints and a 30-minute lockout after 10 failed password attempts. |
| CSP violation reporting | Live /api/csp-report endpoint capturing browser-side policy breaches. |
| Account deletion | GDPR Art. 17 — self-service deletion via dashboard with password re-auth and live-system deletion. The 60-day backup-retention commitment remains unchanged; backup expiry and post-restore deletion controls have implementation verification pending. See the retention-assurance note. |
| Session invalidation | Changing your password, resetting it, or an admin suspension immediately invalidates all existing sessions (token-epoch bump); key rotation and password change require re-authentication. |
| Encryption at rest | Turso (libSQL) managed encryption at rest. API keys are generated with crypto.randomBytes, shown to you in your dashboard, and can be rotated or revoked instantly if exposed. |
| Logging & retention | Raw IPs in stored evaluation records and false-positive reports are one-way hashed after 7 days; hashes remain pseudonymous personal data. Other records follow the Privacy Policy retention rules. Backup assurance limitations are noted above. |
For procurement teams
Self-serve, no email required: the security whitepaper, the Data Processing Agreement, and the sub-processor list with dated change log. Everything else below is available on request from support@maskbreak.com:
| Document | Notes |
|---|---|
| Data Processing Agreement (DPA) | Self-serve — UK GDPR / EU GDPR Article 28 aligned, binds on acceptance with no signature required. Standard Contractual Clauses / UK IDTA for international transfers and a countersigned copy available on request. |
| Master Services Agreement (MSA) | For customers who can't accept the click-through Terms. |
| Security questionnaires (SIG-Lite, CAIQ, bespoke) | Completed for your review within 5 business days of request; complex ones can be co-walked on a video call. |
| Penetration testing status | No third-party penetration test has been commissioned yet — we say so rather than imply otherwise. A responsible-disclosure program is active (see security.txt); this row will be updated when a pen-test is completed. |
| Sub-processor change notice subscription | 30-day advance notice via email for any new sub-processor that processes customer data, with right to object. |