Last updated: August 6, 2026 · Effective: August 6, 2026
What we actually have in place, and what we do not
Domain Scout is a small operation, and we would rather describe our security accurately than impressively. This page sets out the controls we actually run, and names the places where we rely on a provider rather than on something we built.
Where we do not have something, we say so on this page rather than leaving you to assume otherwise.
Traffic between your browser and our servers is encrypted with TLS 1.2 or better , negotiated by our hosting providers. Data at rest is encrypted by Supabase , our database provider. This is not end-to-end encryption: our servers and Supabase can read your data in plaintext in order to run the service.
Passwords are hashed with per-user salts by Supabase , our authentication provider. We also support Google OAuth 2.0 so you can sign in without a password at all. Rate limiting slows brute-force attempts.
Our backend runs on Fly.io and our frontend is hosted on Cloudflare Pages . Cloudflare fronts the site and provides DDoS protection and a global edge network.
We never sell your personal information , and we aim to honour the rights GDPR and the CCPA give you. Our Privacy Policy lists every third party that receives your data and is explicit about what we have not built yet.
We want to be straightforward here: we do not run a real-time security monitoring or alerting service, and there is no on-call rotation. What exists is the ordinary application and request logging produced by our hosting providers, plus a health check on the backend. If you spot something wrong, telling us is genuinely the fastest way we will find out.
Our application implements multiple layers of security controls to protect against common web vulnerabilities and attacks.
We would rather describe this accurately than dress it up. Our backend connects to the database with a service-role credential, which means database-level row security is not what keeps one account's data away from another's. Separation is enforced in application code: every query that touches your records is scoped to your user ID.
Your data lives on Supabase managed infrastructure, and database backups are handled by Supabase under the terms of our plan with them. We do not operate a separate backup system of our own, and the backup frequency and retention window are whatever Supabase provides — so we do not quote a number here that we cannot independently verify.
We carefully vet all third-party service providers and ensure they meet our security standards and compliance requirements.
Security is integrated into every phase of our development process, from design to deployment and monitoring.
We do not currently run static application security testing (SAST) in CI, and we do not have automated dependency-update pull requests configured.
Domain Scout itself holds no security certification. We have not undergone a SOC 2 audit or any equivalent third-party assessment, and we do not claim one. What follows is what is actually true.
We value the security research community and encourage responsible disclosure of security vulnerabilities. If you discover a security issue, please report it to us and we'll work with you to resolve it. We do not run a paid bug bounty programme and do not offer rewards.
Safe harbour: If you make a good-faith effort to follow the guidelines below, we will not pursue or support legal action against you for your research, and we will treat your report as an authorised contribution to the security of our systems. If a third party brings action against you for work that stayed within these guidelines, we will make that authorisation clear.
Security Contact: support@domainscout.co
Response: This mailbox is monitored by a small team, not a 24/7 rota. We aim to acknowledge critical reports within one business day and all other reports within three
Scope: domainscout.co and *.domainscout.co
For more information about how we protect your data and privacy, please review our related policies:
Loading interactive experience…