Security at Trustfield
Last updated: 2026
This page describes mechanisms that are live today. It is deliberately narrow: we do not claim certifications, audits or guarantees we have not completed.
What the scan stores
- The report: findings, short evidence snippets, the target URL, the score and the email you provide.
- We do not copy your source code, do not run or store your database, and never ask for model API keys.
- Reports are deleted from our servers 30 days after the scan. Anonymous aggregate statistics (no target, no email) may be kept to publish issue trends.
- Deletion requests: /delete-account or email info@trustfield.dev. We delete within 7 days.
Payments and card data
Payments run through Razorpay's hosted checkout. Card details are entered on Razorpay's page, not on ours, so card data never touches Trustfield servers. Payment webhooks are verified with HMAC-SHA256 signatures and the expected amount, currency and report id before any report is unlocked.
Subprocessors
We use a small set of vendors to run the product. The current list, with what each one handles, is on /subprocessors.
What we do not use
- No third-party analytics or advertising scripts. The page's CSP only allows scripts from trustfield.dev itself.
- No tracking cookies. The marketing site sets no cookies.
Headers on this site
| Header | Value |
|---|---|
| Strict-Transport-Security | max-age=31536000; includeSubDomains |
| Content-Security-Policy | default-src 'self'; no third-party script; object-src locked down |
| X-Frame-Options | DENY |
| X-Content-Type-Options | nosniff |
| Referrer-Policy | strict-origin-when-cross-origin |
| Permissions-Policy | camera, microphone and geolocation disabled |
Responsible disclosure
If you believe you found a vulnerability in Trustfield itself, email info@trustfield.dev with steps to reproduce. We will acknowledge within 2 business days, tell you honestly what we can fix, and we will not pursue legal action for good-faith testing that stays within your own account and data.
Scanner identity
Our scanner identifies itself with a User-Agent that includes Trustfield and a link to /bot. If you want your site excluded from scans, email info@trustfield.dev and we will block it.