Specific controls. Documented limits. No borrowed credibility.
Security and reliability claims should be inspectable. This page separates what is available today from beta access, explains automated boundaries, and names the controls implemented across the public API platform.
Know what you are evaluating.
“Production” describes an available, billable API surface. It does not imply a certification, customer count, or guarantee beyond the written product scope.
Automated website accessibility and security-exposure checks plus document/PDF discovery and remediation; not a penetration test, legal review, or ADA/Section 508/WCAG compliance certification.
Automated accessibility evidence and assisted remediation; human WCAG review remains necessary.
Narrow read-only exposure checks; not a comprehensive application security audit.
Approval and record system; the caller executes and reports the production action.
Frontdesk, Picks, Counsel, and One API plans are not represented as generally available.
Designed around narrow authority.
These are implementation statements, not a substitute for your own vendor review. Product-specific terms and documentation control when they are more precise.
- Transport
- Public product and API traffic is served over HTTPS.
- Credentials
- API keys are delivered once and are intended for server-side secret storage, never browser code.
- Tenant data
- Products that store tenant records use database-level row policies where documented for that product.
- Payments
- Paid API and Launch Check transactions use Stripe-hosted checkout and signed webhook processing.
- Scanning
- URL scanners reject localhost, private, reserved, and metadata network ranges and re-check browser requests.
- Retention
- Sentinel stores evidence and metadata needed for findings; exposed database row contents are not retained.
Found something that could put people or data at risk?
Email a concise reproduction, affected URL, potential impact, and safe contact information. Do not access data that is not yours, degrade service, or publicly disclose an unresolved issue.