Security and data

• Your account: your email address, your name if you give one, and your password as a salted hash. If you sign in with Google or GitHub, we keep the account link and sign-in tokens they return instead of a password. For each signed-in session we keep the IP address and browser it came from, so you can recognise it.
• Your audits: the URL you audit, the result of each check, and the page addresses each finding lists. We do not keep a copy of your pages.
• Support messages: what you write to us, and any screenshot you attach.
• Nothing from your forms: the crawler never fills in or submits a form on your site, so we hold nothing your visitors type into one.

Audits stay in your account until you delete them. Deleting a site from your sites list removes every audit of it, and deleting your account removes the account and all of its audits. You can export your data or delete your account at any time from your account settings.

Our daily database backups are kept for 14 days, so deleted data drops out of them after that. For your rights over your personal data, and how to use them, see our privacy policy.

• It identifies itself as AuditZapBot in its user agent (AuditZapToolBot for the free tools), with a link back to auditzap.io.
• It only fetches public addresses. Every redirect is checked again before we follow it, so an audit can never be pointed at a private network.
• Two checks fetch differently, on purpose. The AI crawler firewall check requests your site once as a normal browser and once as GPTBot, to see whether your firewall treats AI crawlers differently. Core Web Vitals are measured by Google PageSpeed Insights, which fetches the page itself.
• If your firewall refuses our connection, the failed audit tells you what to ask your host to allow.

The free tools need no account and store none of the URLs you check. If you ask for your results by email, we keep your email address and which tool you used.

These services process data on our behalf.

Hetzner

Servers and database

Runs the app, the crawler and the database, in Germany.

Cloudflare

Network and bot protection

DNS and the proxy in front of auditzap.io, plus the Turnstile check on our public forms.

Cloudflare R2

File storage

Stores screenshots you attach to a support message, and the logo an Agency account adds to its reports.

Lemon Squeezy

Payments

Our merchant of record. It takes the payment and handles tax, and your card details never reach our servers.

Resend

Email

Sends account, report and product emails to your address.

Anthropic

AI fix instructions

Writes the AI fix instructions. For those we send the check results: each check's name, status and finding. We never send the HTML of your pages or your email address. We also use it in internal tools, such as drafting support replies that a person reads before anything is sent.

Google PageSpeed Insights

Core Web Vitals

Measures loading speed and layout shift. It receives the address of the page being measured and fetches it itself.

Sentry

Error reports

Receives error reports so we can fix bugs, with default personal data collection turned off.

Google Analytics and Microsoft Clarity

Analytics

Measure how people use our website. Their analytics cookies are set only after you accept them in the cookie banner.

• Passwords are hashed with scrypt by Better Auth, our sign-in library. We never store the password itself.
• A new account has to confirm its email address before it can sign in.
• You can turn on two-factor authentication with an authenticator app, with backup codes, in the Security tab of your account settings.
• The same tab lists every signed-in session, and you can sign out any one of them, or all of them.
• Agency API keys are stored only as a hash. We show a key once, when you create it.
• Every page and API call is served over HTTPS.

If you find a vulnerability, send it through our contact form with Security in the subject. It goes straight to the support queue, which a person reads. Please give us a fair chance to fix the issue before you share it.