Security & privacy

• All traffic is TLS 1.2+; scan evidence is encrypted at rest.
• Scans capture public page behaviour and metadata, not end-user personal data.
• Test credentials supplied for authenticated scans are encrypted and used only during the run.
• Role-based access separates owners, admins and read-only members.
• Workspace deletion removes scans, reports, documents and evidence within 30 days.

Reporting a vulnerability

Email security@checklegal.ai with reproduction steps. We acknowledge within one business day and do not pursue good-faith researchers.