Security and privacy

A plain-language summary of what Allie does with your data. It describes how the service works today. The full privacy policy and terms are separate pages.

What happens when you scan a URL

• Allie loads the page once in an isolated, temporary browser session with no cookies or login of yours. Downloads are disabled and the session is closed when the scan ends.
• We save the URL, the time of the scan and the results (which include the HTML of the elements that failed, so we can show you the problem) so you can open the report.
• Anonymous scans are linked to a hashed, salted version of your IP address, only to apply daily usage limits. We do not store the raw IP address in our database.

Who can see your reports

Each report has a long, random, unguessable link. Anyone who has the link can open it, which is how you share a report with a colleague. Do not publish a report link if the page content is sensitive. Reports are not listed publicly or searchable.

How long we keep data

Scan results are kept until you delete them. We do not currently delete scans automatically. If you have an account, you can delete any scan from your history at any time. To have your account and data removed, email hello@a11ie.io. Login sessions last up to 30 days and expired sessions are removed automatically.

Accounts and passwords

We store your email address and a salted scrypt hash of your password, never the password itself. Email verification and password reset links are random single-use tokens, and only a hash of each token is stored. Resetting a password signs out all sessions.

Payments

Payments are processed by Stripe. You enter card details on Stripe's checkout page. Allie never receives or stores card numbers. We keep your plan status and Stripe's customer reference so we can unlock your reports and let you manage billing.

Protections built into the scanner

• SSRF protection: Allie only tests public websites. Before every request, including redirects and the images and scripts a page loads, the address is checked. Private, internal, loopback, link-local and cloud-metadata addresses are refused, and only standard web ports are allowed. Embedded credentials in URLs are rejected.
• Limits: each scan has time limits, and requests are rate limited per address and per account to prevent abuse.
• Identification: scans use the user agent AllieA11yBot/1.0 so site owners can recognise them.

Protecting the service

• The site is served over HTTPS, with HTTP Strict Transport Security enabled in production.
• A strict Content Security Policy: no inline scripts and no third-party scripts or resources on our pages.
• We do not use advertising trackers or third-party analytics on the site. The only cookie is the login session cookie, which is HTTP-only.

Service providers

We use Stripe for payments, Resend to send verification, password-reset and account emails, and a cloud hosting provider to run the app. They process data only as needed to provide those services.

Report a security issue

If you believe you have found a vulnerability, please email hello@a11ie.io with details. Please do not test against other users' data.

We do not claim any security certification or audit. This page describes the measures above and nothing more.