Data processing addendum

When we scan a page on your instruction, the result can contain personal data that is yours, not ours. That makes you the controller and us the processor, and Article 28 of the UK and EU GDPR requires written terms for it. These are them.

Last updated 29 July 2026.

1. What is being processed, and why

Subject matter: providing automated accessibility scanning and the tooling around it.

Duration: as long as your account exists, plus the deletion periods in section 7.

Nature and purpose: loading a page you specify, analysing its markup with axe-core, and storing the findings so you can compare them over time.

Categories of data subject: anyone whose personal data happens to appear in the markup of a page you ask us to scan — your users, your customers, your staff. Also the recipients of any monitor alerts you configure.

Categories of personal data: whatever is in the fragment of markup attached to a finding. Typically nothing. Sometimes a name in an image's alt text, a username in a link, an email address in a form's value. We do not choose it and cannot predict it — you do, by choosing what to scan.

2. We act only on your instructions

We process personal data only to provide the service and only as you instruct — submitting a URL is the instruction. We will not use it for our own purposes, will not sell it, will not use it for advertising, and will not use it to train machine-learning models.

If an instruction seems to us to breach data protection law, we will tell you rather than quietly carry it out.

3. Confidentiality and people

Access is limited to the people who need it to run the service, under confidentiality obligations. In practice that is a very short list, and access to production data is not part of anyone's normal working day.

4. Security measures

The measures we actually take, rather than a list of adjectives:

• TLS for everything in transit, HSTS on the website, and a Content Security Policy that blocks all external connections.
• Passwords stored as argon2id hashes. API keys, session tokens and email tokens stored as hashes, never in plaintext.
• The database listens only on localhost. It is not reachable from the internet, and not reachable from the machines that render scanned pages either.
• The browsers that load your pages hold no credentials at all. They receive a job over a queue and return a result; they have no database access, no API keys and no route to private address space. If one were compromised by a hostile page, there is nothing on it to take.
• Every submitted URL is validated before it is fetched, and re-validated at every redirect, to stop the service being used to reach internal systems.
• Nightly database backups, each one verified by being restored into a scratch database and having its rows counted, because an unrestored backup is not a backup.
• Rate limits per key and per IP address. IP addresses exist only as a Redis counter with a two-minute expiry and are never persisted.

We may change these measures, but not in a way that materially reduces security. The security page keeps the current detail.

5. Sub-processors

You give general authorisation for the sub-processors listed on the sub-processors page. We impose data protection terms on each of them no less protective than these, and we remain responsible for what they do.

We will give at least 30 days' notice by email before adding one that can access your personal data. If you reasonably object on data protection grounds, tell us within those 30 days and we will either find another route or let you terminate the affected part of the service with a refund of unused prepaid time.

6. Helping you meet your own obligations

We will assist you, at no charge for anything reasonable, with:

• requests from data subjects — you can already search, export and delete scan data yourself through the API, which is usually faster than asking us;
• data protection impact assessments and prior consultations, to the extent they concern our processing;
• demonstrating compliance, including by giving you the information in these pages and answering specific questions in writing.

We will notify you of a personal data breach affecting your data without undue delay and in any event within 48 hours of becoming aware, with what we know, what we are doing, and what we do not yet know. We would rather send an incomplete notification quickly than a tidy one late.

7. Deletion and return

You can delete any scan, report, monitor or workspace at any time through the API or the dashboard, and it is deleted from the database when you do.

Scan results are deleted automatically after 13 months whether you ask or not — holding them longer serves us, not you.

When your account closes, we delete your data within 30 days. Backups age out on their own retention cycle and are gone within a further 14 days, which is why the total is not instantaneous. The exception is the usage ledger: those rows are financial records we are required to keep for 7 years, and they are reduced to an account identifier, a date and a count — no URLs and no scan content.

Before deletion you can export everything through the API. Ask us and we will produce a full export if the API is not enough.

8. Audits

We will answer a reasonable written security questionnaire once a year at no charge. We do not currently hold ISO 27001 or SOC 2 — we are a small company and saying otherwise would be a lie you could check. If you need an on-site audit, we will discuss it, and we will not pretend a certification exists in order to close a deal.

9. Liability and precedence

Liability under this addendum is subject to the limits in the terms of service. Where this addendum and those terms conflict on the processing of personal data, this addendum wins.