Security & data handling
Security is not the main topic of this app. We care anyway.
You are letting a robot read your website and store pictures of it. For authenticated scans, you can provide a login. This page answers what happens to all of that — in the order your IT department asks.
Everything we hold about you, on one screen
Four rows. If your data protection officer wants the long version, the processing agreement says the same thing in legal language.
Delete a website and its screenshots and findings go with it, within 24 hours. Close the workspace and everything except statutory invoice records is gone within 30 days. Both are buttons in the app, not an email to us.
What the scanner does to your website — and what it will never do
The question behind the question is usually "will this break something, or set off our monitoring?". Short answer: no, and here is what to tell the person watching the logs.
The scanner does
- Loads pages in a real Chromium browser, JavaScript and all
- Identifies itself as OpenForAllBot/1.0 from fixed IPs you can allowlist
- Stays on the selected origin and within your page limit
- Paces itself — roughly one page every two seconds, one browser at a time per site
The scanner never does
- Submits a form, adds to a basket, or triggers a payment
- Probes for vulnerabilities — this is not a pen test and will not find one
- Follows a redirect to an internal address, a loopback, or a private range
- Scans a domain nobody in your workspace has confirmed owning
Show IP and bot identity
Need to allowlist us? Some websites block known bots by default. Allow the fixed IP and bot name so scans can run reliably.- Current scanner IP
88.99.161.204- Bot identity
OpenForAllBot/1.0
Access, accounts and who can see what
Authenticator app. The secret stays with us and is never sent to a third-party identity provider. Recovery codes are shown once and stored only as hashes.
An agency can invite a client into the workspace without exposing the rest of the portfolio. The separation is enforced on the server, not by hiding menu items.
Sign-ins, permission changes, deletions and suppressed findings are recorded in your workspace and exportable — not just visible to us.
Support cannot enter your workspace unless you turn on access for a session. When we do, it is logged in your audit log where you can see it.
Standing answers
Four questions every questionnaire asks
Answered here so you can check them before writing to us. If your process needs something we do not have, it is better to know at the start.
No ISO 27001, no SOC 2. Our technical and organisational measures are written up and we send them on request.
Monday to Friday. Scans are queued work — a delayed scan waits for the morning rather than an on-call rota.
To you directly and in writing, with what we know at the time — not only a status page update.
Hetzner, Stripe, Postmark, Cloudflare. The current list is versioned and changes are announced 30 days ahead.
Ask us directly
Two different conversations, one form.
Pick "Security & data handling" on the support form and it routes straight to the person who can answer, with the questionnaire attached if you have one.
- Procurement: DPA, technical measures, subprocessor list, hosting and retention — usually answered within two working days.
- Found a vulnerability in OpenForAll? Mail security@openforall.io — we reply within two working days, we will not send lawyers at you, and we credit you if you want it.
Support form · topic
- Your questionnaire or DPA template, if you have one
- Whether you need authenticated scans
- Any hosting or retention constraint you must meet
Please do not paste credentials, tokens, or anything from a live incident into this form.