Collect less, protect it better
The best protection is not holding what we don't need. We don't ask for payment cards, government IDs or passwords on this website, and most free tools process your text in your own browser instead of sending it to us.
Email confirmation for the heavier tools
Tools that do real work on our servers, or that produce code and files, release their results only after you confirm your email with a one-time link. This keeps the tools fast, stops automated abuse, and means the addresses on our list are real and belong to the people who gave them.
- Each link is random, tied to one address and one tool, and expires after 24 hours.
- Only a hash of the link is stored, and unused links are purged within 48 hours.
- Confirming unlocks the tool in your browser only, using a signed, HTTP-only cookie that can't be forged or read by scripts on the page.
- Results logic for the gated tools is delivered by the server only after confirmation; it isn't sitting in the page source.
Protection against abuse
- Brute force and flooding: per-address and per-network rate limits on sign-ups, confirmations, lookups and the page analyzer; daily caps per email and tool.
- Bots: hidden honeypot fields on every form, email confirmation, and rejection of disposable and personal addresses on the tools.
- Injection and malformed input: every field submitted through a public form is validated and length-limited on the server, control characters are stripped from anything that reaches an email header, and output is escaped before it is displayed. The page analyzer only fetches public web addresses and refuses private, internal and local network targets.
- Locking: files are written with locks and time-outs, so a stuck request can't take the site down.
Storage
- Submissions are stored in a private data folder that the web server is configured never to serve directly.
- Connections to auditgeek.agency use HTTPS (encryption in transit).
- Secrets such as signing keys and deployment tokens are kept on the server, outside the public site and outside the code repository.
Access
- The admin area is limited to named team members and uses role-based permissions, so people only see what their job needs (for example, writers can't see leads).
- Our team uses submitted details only to deal with your request or to send the communications you agreed to.
Your data, your control
You can ask to see, correct, export or delete what we hold, or unsubscribe at any time. Email [email protected]. More detail is in our Privacy Policy and Terms of Service.
Found a problem?
If you believe you've found a security issue, please email [email protected] with the details. Please don't access other people's data or disrupt the site while testing; we'll look into every genuine report promptly.
Last updated: October 31, 2026.
Privacy Policy · Terms of Service · Data Security