Security
What we do to keep your account, your published pages and your leads safe, written plainly, including the parts we have not built yet.
What is in place today
- Encryption in transit for the app, the API and every published page, with SSL provisioned automatically for custom domains
- Passwords stored as salted hashes, never in a readable form
- Visitor IP addresses stored as a one way hash rather than in the clear
- Role based access inside organizations and workspaces, so a client can be given their own workspace and nothing else
- Signed internal requests between our edge worker and our API, so submissions cannot be forged
- Bot and spam protection on forms, using a hidden honeypot field and Cloudflare Turnstile where you enable it
- Per form webhook signing, so your receiving endpoint can verify the payload came from us
- Static pages served from a global edge network, which removes a large class of application attack from the page surface
What we do not have
We do not hold a SOC 2 report or ISO 27001 certification, and we will not imply that we do. We are a small team. If your procurement process requires either one, tell us early and we will be straight with you about where we are rather than waste your time.
Security reviews
If you need a security questionnaire completed for a client or an internal review, email team@dearconvert.com and we will fill it in. We are preparing a standard completed questionnaire so this becomes a download instead of a wait.
Reporting a vulnerability
If you think you have found a security issue, email team@dearconvert.com with enough detail to reproduce it. We will confirm we received it, keep you updated, and we will not pursue you for good faith research that does not harm customers or their data. Please do not test against another customer's pages or data.