Security and trust
Last changed 16 September 2026.
A security check you cannot trust is worse than none. This page says what we do with your site, your keys and your data, in the same plain English we use in a report.
What a check touches
A free check reads what any visitor to your site could already read: your public pages, the public addresses your app talks to, and the public key your app already ships to every browser. It sends nothing to your site that a normal visitor could not send.
Checks that go further, such as signing in as a test user or reading your database rules, need two things from you: proof that the site is yours, and a switch you turn on yourself on a screen that says exactly what the check does. Nothing that could change your data runs without that switch.
What we keep from your site
- A count of how many records a problem exposed, and the names of the columns.
- One sample record, with every value blanked past its first two characters, so you can see the finding is real.
- A picture of a leaking screen, blanked the same way before it is saved.
- Your scores and findings over time, so you can see what you fixed.
We never keep your customers’ names, emails, addresses, or anything else that was in the records. This is enforced in the code that saves a finding, not by a policy someone has to remember.
Keys you give us
If you hand us a key for the deeper checks, it is encrypted before it is stored, it is never shown to anyone again, including you, and it is used only for the checks it unlocks. You can remove it from your account at any time and it is deleted, not disabled.
Where things live
Your account, your findings and your billing are handled by a small number of companies we rely on. They are listed, with what each one sees, in our data processing terms.
Reporting a problem in GuardCue
If you find a security problem in GuardCue itself, email support@guardcue.com with "security" in the subject. We will not take action against anyone who reports in good faith, and we will tell you what we did about it.