Security & data protection

All traffic is served over TLS (HTTPS only), with HSTS enforced — browsers refuse to ever downgrade the connection. Certificates are issued and rotated automatically.

Screenshots, heatmaps, reports and account data are stored on infrastructure located in France and never leave the EU. We are a French company, subject to GDPR by default — not as an afterthought.

Pulse, our behavioral snippet, uses no cookies and no fingerprinting. Mouse positions are aggregated into coarse grids in the browser before they are sent; we never store individual trajectories, IP-based profiles or anything that identifies a visitor.

Anonymous score scans are purged after 30 days. Email verification codes expire after 10 minutes and are purged within the hour. Your projects and reports stay until you delete them — deleting a project deletes its captures.

Payments are processed by Stripe. Your card number never touches our servers — we only store the subscription state.

Strict security headers (CSP, HSTS, nosniff), rate limiting on every endpoint, bounded and validated uploads, and SSRF protection on our capture service. The Pulse SDK source is small enough to read in five minutes — audit it yourself.