Security & trust
You’re trusting AstraScope to look at your website. Here is exactly what it does, what it refuses to do, and how your data is handled.
You prove the site is yours before we monitor it
Continuous monitoring requires ownership verification. You prove control of a site with a DNS TXT record, a file at a /.well-known path, or a meta tag on the homepage.
A one-off Deep Audit can be run against any publicly reachable URL, because it only reads pages that are already public.
What a scan actually does
AstraScope requests your public pages over HTTP with a normal, identifiable user agent (AstraScopeBot). It only ever performs safe GET requests.
It never submits forms, never logs in, never modifies content, and never attempts to exploit anything. It reads response headers and HTML, and renders your homepage in a browser to take screenshots and measure loading.
Crawling respects robots.txt, stays on your own origin, and is bounded in pages, depth and response size.
We cannot be pointed at private infrastructure
Every URL you submit is validated before any request is made. Requests to loopback, private (RFC 1918), link-local, carrier-grade NAT, and other reserved ranges are rejected — including when they are disguised as decimal, octal, hexadecimal or IPv4-mapped IPv6 addresses.
Only http and https on standard ports are allowed, URLs containing credentials are rejected, and every redirect hop is re-validated rather than blindly followed. The headless browser used for deep audits applies the same rules to every request the page makes.
Your reports are private
Screenshots and generated PDF reports are stored in private object storage. They are never public: access is authorised against your account on every request, so knowing a file's location is not enough to read it.
Sessions use signed, httpOnly cookies. State-changing requests are additionally protected by a same-origin check, and the app is served with a strict Content-Security-Policy.
We never see your card
Payments are handled by Stripe on Stripe-hosted pages. AstraScope does not receive, process or store card details. Plan changes are always derived from Stripe on the server — never trusted from the browser.
You can take your data out, or delete it
You can export your account data as JSON at any time from Settings. Deleting your account removes your sites, monitoring history, audits, findings, screenshots and reports, and cancels any active subscription.
What we don’t claim
AstraScope holds no security certifications, and we don’t display badges we haven’t earned. Our security checks are passive configuration checks — they are not a penetration test and cannot tell you your site is secure. Our accessibility checks are automated and cannot certify WCAG compliance. We’d rather tell you the limits than oversell the product.