Trust
Security & data
What runs this site, what we store, and what we don't. No certifications are claimed here because we don't hold any.
Infrastructure
| Hosting | Cloudflare Pages (static site) and Pages Functions (API). Everything is served over HTTPS. |
|---|---|
| Database | Cloudflare D1 (SQLite), one database for the whole site. |
| Payments | Stripe-hosted checkout (Payment Links). Card details are entered on Stripe's pages and never reach our servers. |
| Resend, sending from mail.metadatastyleguidelines.com. | |
| Headers | Every response sets X-Content-Type-Options: nosniff, X-Frame-Options: DENY, Referrer-Policy: strict-origin-when-cross-origin and a restrictive Permissions-Policy. |
What the checker does with your file
- The CSV or JSON you check is processed in memory by a Pages Function and is not written to the database.
- Limits per request: 2 MB body, 5,000 rows; 30 requests per minute per IP.
- If you unlock the full report with your email, we store the email, optional name, the report's summary counts (tracks, findings, errors, warnings, score, grade), the consent wording you agreed to with a timestamp, and a report token.
- The file itself, and the individual findings, are not stored.
What else we store
- Contact, audit-request, API-access, newsletter and kit-waitlist form submissions.
- A log of emails we've sent you, so the follow-up sequence doesn't repeat.
- IP addresses only as SHA-256 hashes, used for rate limiting and consent records.
- API keys only as SHA-256 hashes; the plain key is shown once when issued. Per-key usage counts for quotas.
There is no automated deletion schedule yet. To have your records deleted, contact us and we'll remove them by hand.
Email and consent
We email you only after you tick an unchecked consent box (CASL express consent) or ask us to. After unlocking a report you get the report and up to three follow-ups over ten days. Every email has an unsubscribe link and a one-click List-Unsubscribe header (RFC 8058); unsubscribing stops the sequence immediately. Every email footer carries our postal address, as CASL requires.
Not claimed
We don't hold SOC 2, ISO 27001 or any other certification, and we don't sign custom DPAs today. If your procurement needs something specific, ask and we'll tell you plainly what we can and can't do. See also the privacy policy.