Security

ValidVisit is a tool for finding untrustworthy traffic, so being trustworthy with data is the point. We collect the minimum needed to judge whether a click is genuine and no more.

• Network addresses are reduced to a one-way hash before storage — the raw IP is never written to disk.
• Data is encrypted in transit with modern TLS.
• Each customer’s data is scoped to their own sites; identifiers are never shared between customers.
• Aggregated reports hold counts and verdicts only — they carry no per-visitor identifiers.

Security is built into how we ship, not bolted on afterward:

• A dependency audit blocks any change that pulls in a package with a known high-severity flaw.
• Every change passes type-checking, linting and the test suite before it ships; the gate is the same one, every time.
• The tracking script ships with an integrity hash, so a tampered copy is refused by the browser.
• The browser tag publishes a subresource-integrity hash — served alongside the script and at a dedicated integrity endpoint — so you can verify exactly which build runs on your pages.
• Access to production data follows least-privilege — limited to the people who need it to run the service.

The strongest way to protect data is not to hold sensitive data in the first place. We don’t store raw IPs, we don’t ask visitors for personal details, and we don’t build cross-site advertising profiles. See the privacy policy for the full picture, including data retention and your erasure rights.

If you believe you’ve found a security issue, we want to hear from you. Email hello@validvisit.com with the details and steps to reproduce. Please give us a reasonable window to investigate and fix before any public disclosure; we won’t pursue good-faith researchers who follow responsible disclosure.

Our data practices are built to support GDPR, UK GDPR and CCPA/CPRA obligations — including data minimization, per-site scoping, and a permanent right-to-erasure path. As the product matures we’ll continue to strengthen our controls and pursue formal attestations where they add value for customers.

Security questions or documentation requests can be sent to hello@validvisit.com.