Trust center
Everything a buyer, lawyer or platform reviewer asks — in plain English. No certificates we do not have.
Download the security overview (PDF) Read the questionnaire answers
Quick facts
| Topic | What we do |
|---|---|
| Data we store | Report findings, short evidence snippets, target URL, score, your email. No source code, no database contents. |
| Retention | Reports deleted 30 days after the scan; email kept until you ask us to delete it; anonymous aggregate stats may be kept. |
| Payments | Razorpay hosted checkout. Card data never touches our servers. Webhooks are HMAC-verified with amount and report id checks. |
| AI | Optional report copilot uses DeepSeek's API with the report text and your question. No model training on your data. |
| Subprocessors | Render, Supabase, Cloudflare, Razorpay, Resend, Hostinger, Ahrefs (cookieless aggregate analytics). |
| Certifications | None. Not SOC 2, not ISO 27001, not a penetration test. We describe mechanisms instead of claiming certificates. |
Read the details
- Security page — storage, payments, headers, disclosure.
- Subprocessors — every vendor, purpose, data and region.
- Methodology — what each check does and how it can be wrong.
- Refund policy — what is covered and how to claim.
- Status — current state and known incidents, honestly.
- Changelog — dated changes, including fixes to our own false positives.
- Privacy · Terms
Requests we accept
- NDA — email us, we sign a mutual NDA for a real evaluation.
- DPA — data-processing addendum available on request for business customers.
- Data deletion — /delete-account or email; done within 7 days.
- Security questionnaire — the PDF pack answers the usual 16 questions; send us any extra ones and we answer by email.
- Vulnerability reports — responsible disclosure with safe harbour for good-faith testing: /security.
Trustfield is a sole proprietorship of Dhruv Kumar, Faridabad, India. Contact: info@trustfield.dev. We answer usually within one business day.