Trust & compliance

The site and API run on Vercel ([Hosting region, e.g. Washington, D.C., USA]). Data is stored in a Neon Postgres database ([Database region]) over an encrypted (TLS) connection. There are no other copies of your data outside these providers and the sub-processors below.

Scans also look up the audited domain in public sources: the Internet Archive (Wayback Machine), Common Crawl and Wikidata. They receive the website's address only. We do not use analytics, advertising or tag-manager services.

Automatic deletion periods for audits and messages are not yet in place. [Retention periods to be set.]

• HTTPS everywhere, with HTTP Strict Transport Security (one year, including subdomains).
• Security headers on every response: X-Frame-Options DENY, X-Content-Type-Options nosniff, a strict Referrer-Policy and a Permissions-Policy that disables camera, microphone and location.
• No passwords. Sign-in is Google OAuth with state and PKCE checks; only verified Google emails are accepted.
• Sessions use 256-bit random tokens in HttpOnly, SameSite=Lax, Secure cookies; the database stores only their SHA-256 hash.
• Unguessable report links (144-bit random share tokens); audits run while signed out can be saved to an account only from the browser that ran them.
• Same-origin checks on account actions such as sign-out, saving audits, overriding checks, editing your name and deleting your account, and rate limits on audits, sign-in, forms and other public endpoints.
• SSRF-safe fetching. The crawler resolves every hostname and refuses private, loopback, link-local and cloud-metadata addresses, connects only to the address it checked, re-checks every redirect and allows only standard web ports.
• Server-only scoring. The KPI checks and scoring model run on our servers; the browser receives results, not the scoring logic.
• No secrets in the browser. API keys and credentials live only in server environment variables.
• Minimal personal data. Contact-form IP addresses are stored only as a one-way hash; credentials found in a scanned site's public code are kept only in redacted form.

• Public pages only. We fetch pages anyone can reach without logging in. We send only GET and HEAD requests, never submit forms and skip admin, login and API paths.
• Identified crawler. Crawl requests use the user agent ContentMasBot/1.0 and respect robots.txt Disallow rules for all agents and for ContentMasBot.
• Limits. Pages per site audit follow your plan (10 on Free, at most 1,000), three requests at a time, about two and a half minutes of crawling, 10 seconds and 2 MB per request, and three redirects.
• Comparison checks. To test AI and search visibility, a fixed small number of requests (at most 40 for the AI-visibility checks) re-fetch key pages using browser and AI-crawler user agents (such as OAI-SearchBot and ClaudeBot) to see whether they receive the same content.
• Rate limits. Each visitor can start only a few site audits in a short period.

Site owners can block ContentMasBot in robots.txt or ask us to stop scanning their domain through our contact form.

Signed-in users can export their data as JSON and delete their whole account and its reports themselves in Dashboard → Settings. You can also ask for a copy of your data, its correction or deletion, or object to processing: send requests through our contact form with the subject "Privacy". We reply within one month, or sooner where your local law requires. See Your rights for details by region.

If you find a security issue in ContentMas, please tell us through our contact form with the subject "Security", including steps to reproduce. Do not access other users' data, degrade the service or publish details before we have fixed the issue. We will acknowledge your report and keep you updated. Good-faith research that follows these rules will not be pursued.

Each audit detects the audience region of the site (for example the EU, UK, US, India, Pakistan or the Gulf) from signals such as the domain, addresses, phone codes, language and currency, and you can set it yourself. It then applies region-aware checks for:

• Privacy: a findable privacy policy and the disclosures expected under laws such as GDPR, UK GDPR, CCPA/CPRA, India's DPDP Act and the UAE PDPL;
• Cookies: whether a consent mechanism is present where trackers and non-essential cookies are used, as the ePrivacy Directive and PECR expect;
• Accessibility: common technical barriers and an accessibility statement, applying the European Accessibility Act and UK public-sector rules where relevant;
• Consumer disclosures: terms, refund, contact and business identity information expected for the site's type and region.

These checks flag likely gaps from what is publicly visible on the site. They are not legal advice and cannot confirm that a site complies with any law. Ask a qualified lawyer before relying on them.