APIBlogContact

Accounts, data and monitored sites

Security as it is today.

What we do to protect your account, your data and the sites you monitor, and what we have not done yet. Updated October 2026.

01. Controls

What we already do.

  • Your site is only read, never changed

    • WebVyze makes the same public requests a visitor makes. It does not ask for access to the server, the CMS admin or the database.
    • The WordPress plugin, if you install it, adds the real-visitor measurement script and sends the list of plugins and versions; it does not touch other files or settings.
    • Fixes are made by you (or your AI agent). WebVyze then checks again and marks an issue resolved only with evidence.

  • Encryption and secrets

    • All traffic uses HTTPS (TLS 1.2 or higher) with HSTS.
    • Passwords stored with bcrypt. API keys, invites and deploy URLs stored only as SHA-256 hashes.
    • Integration credentials (Jira, Slack, SMTP, webhooks) encrypted with AES-256 and never returned by the API.
    • Cards are processed by Stripe and crypto by BTCPay Server. No card data goes through WebVyze.

  • Isolated accounts and least access

    • Every resource is checked against the requester's account and role (owner, admin, member, client), including over the API and MCP.
    • API and MCP keys are scoped (read or write), expire and act with the permissions of the person who created them.
    • Support enters an account only with a recorded reason, for up to 60 minutes and without sensitive actions.
    • Two-step verification with an authenticator app for each person, with recovery codes; it also applies to Google sign-in. The account owner can require it from the whole team, and it is mandatory for WebVyze staff.

  • Isolated analysis

    • Every outbound request goes through SSRF protection: public addresses only, pinned IP, re-validated redirects and a size limit.
    • When on, browser analysis runs in a separate container with no access to the database or the secrets.
    • The server sits behind Cloudflare and only accepts web connections coming from it.

  • Privacy (LGPD and GDPR)

    • Consent recorded with date and text; e-mail addresses confirmed in two steps.
    • You export your data and delete your account whenever you want, under Account › Privacy.
    • Unconfirmed sign-ups are deleted after 7 days; sales contacts, after the period in the Privacy Policy.

  • Security reviews

    • Two internal code reviews in 2026 (September and October): authorization, outbound network, billing, abuse and front end. Every flaw found was fixed and covered by automated tests.
    • More than 500 automated tests run on every change before it reaches production.

02. Transparency

What we have not done yet.

Not in place yet

  • An external pentest or a review by an independent firm.
  • Certifications such as SOC 2 or ISO 27001.

Found a vulnerability?

Write to privacidade@webvyze.com.br with the steps to reproduce. We reply within 5 business days and take no legal action against good-faith reports that do not access other people's data or degrade the service.

Data processing agreement (DPA) and security questionnaires: same e-mail. Personal data details in the Privacy Policy. security.txt · Availability

Related guides

Partners

Partner benefits with one coupon.

WPLIGHT

Partner links. We may earn a commission at no extra cost to you.