Security
A system this sensitive has to be inspectable.
A consent platform sees every visitor to every customer site, which makes “what do you collect” the first fair question. This page answers it with architecture rather than badges, and lists only controls that are implemented.
Data minimization
Pseudonymous subject keys rather than durable visitor identifiers, and no raw IP kept by default — where an address is needed for routing or abuse control, its retention and transformation are disclosed.
Separated planes
Customer configuration, visitor consent evidence and scanner artifacts are separate stores. A scanner worker cannot reach the control plane's database.
Scanner isolation
Scans run in isolated browser workers with SSRF protection, blocked internal address ranges, download limits and cleanup after each job.
Tenant isolation
Every record belongs to a tenant, and authorization is evaluated per object — for pages, exports and API access alike.
Versioned configuration
Published policies, banners and manifests are immutable, with an audit trail of who changed what and when.
Configurable retention
Receipt and scan-artifact retention is a setting, because evidence has a longer useful life than a log line and a shorter one than forever.
The detail
How each control is actually implemented.
Written for the person filling in a security questionnaire, who needs specifics rather than adjectives.
- Data minimization
- A consent record holds a pseudonymous subject key, not a visitor identifier. There is no cross-site profile, and raw IP addresses are not retained as a durable record — where an address is processed transiently for regional routing or abuse prevention, the retention and transformation are disclosed.
- Separated planes
- Customer configuration, visitor consent evidence and scanner artifacts are separate stores with separate credentials. A scanner worker cannot reach the control plane's database, which matters because scanner workers execute untrusted pages.
- Scanner isolation
- Scans run in isolated browser workers with SSRF protections, blocked internal and link-local address ranges, download and size limits, rate limiting, and cleanup after every job. You may only scan sites you control.
- Tenant isolation and authorization
- Every record belongs to a tenant and authorization is evaluated per object, for pages, exports and API access alike. Consent receipt endpoints carry an additional grant beyond ordinary configuration access.
- Encryption
- Data encrypted in transit and at rest, including scan artifacts in object storage.
- Runtime integrity
- The consent bootstrap is served from a CDN as versioned, signed configuration. It carries no dependency on the dashboard database at request time, so a control-plane incident cannot take a customer's consent enforcement with it.
- Fail-safe defaults
- Under an opt-in configuration, a runtime that cannot load its configuration does not release restricted services. That behaviour is specified and tested rather than emergent.
- Versioned configuration and audit
- Published policies, banners and manifests are immutable, with an audit trail of who changed what and when.
- Retention
- Receipt and scan-artifact retention is configurable per tenant. Evidence has a longer useful life than a log line and a shorter one than forever.
Responsible disclosure
Found something? Tell us before anyone else.
Report a suspected vulnerability to security@dotcensus.com. A human reads it. Please give us a reasonable window to fix an issue before publishing it, and we will keep you updated rather than going quiet.
What this page does not claim
There are no compliance logos here. DotCensus has not completed a SOC 2 or ISO 27001 audit, and publishing a badge before the certificate exists is the kind of claim an enterprise security review catches in the first ten minutes.
If your procurement process requires a specific attestation, tell us which one and we will tell you honestly where it stands.
Bring your security questionnaire.
We would rather answer it in detail now than discover a blocker after you have built a register.
No code to install for a scan Public pages only DotCensus runs on DotCensus