Privacy Policy

We store the domain you scan and the report we generate so we can show you your results and let you download your report. Scans and reports are kept for 30 days (from purchase, or from the scan if not purchased) and then deleted automatically. We do not sell your data.

Payments are processed by Stripe. We never see or store your card details.

We keep basic request logs (such as IP address) to prevent abuse and keep the service running.

Who else sees a domain you scan. To check a domain we look up its DNS records through public DNS-over-HTTPS resolvers (Google Public DNS, with Cloudflare as a fallback), so they receive the domain and the names we look up under it. A DNS & domain recon (Claude connector and API) also searches public certificate-transparency logs (crt.sh, when it's reachable) for the domain and looks up a few dozen look-alike spellings of it the same way. A Knock Knock Full Digital Footprint, on our site or through the connector, does the same, looks up about 1,000 common subdomain names under the domain, and looks up the network that hosts its website in Team Cymru's public IP-to-network registry (also through DNS). The scanned website itself sees our requests, as it would any visitor's.

Claude connector and API. When you use Small Business Security Check through Claude or our API, we receive only what's needed to run the tool you asked for: the tool's inputs (such as the domain to scan, or the answers you give a questionnaire) and your API key. We never receive or store your Claude conversation, chat history or files. We store a one-way hash of your API key rather than the key itself, its run balance and usage counts, and the email address Stripe gives us when you buy runs, so we can help if you lose your key: a key bought here can be re-created from its purchase record, which is how we recover one. When you buy runs for a new key we set one cookie, so that only the browser that started the checkout is shown the key. Scan results saved as reports follow the 30-day rule above; questionnaire answers and other advice-tool inputs are processed and not stored. Key records (the key's hash, run balance, usage counts and purchase email) and the record of each purchase are kept until you ask us to delete them, so a later purchase can still reactivate expired runs on the same key; email us to have your key and its records deleted. Each scan through the connector or API also writes a log entry recording that you confirmed you own or are authorized to assess the domain: the domain, the scan, the time and a short identifier for your key. Those entries are kept for 30 days and then deleted. Apart from the lookups described above, we don't share any of it with third parties except Stripe (payments) and Google Cloud (hosting).

Want your scan and report deleted? Email smallbizsecuritycheck@gmail.com and we'll remove it.