Trust & security
We scan the URL you give us. Nothing else.
Siteory fetches public pages, stores the report for your account, and keeps the dashboard off the public index. This page describes what the product does today, not a promise that scans are completely safe.
What a scan is allowed to touch
You must only submit sites you own or have permission to audit. The crawler requests public HTTP(S) URLs on that host with User-Agent: SiteoryBot/1.0 (+https://siteory.co/security). It does not guess passwords.
The crawler honors User-agent: * rules in robots.txt. If the start URL is disallowed, that is recorded and the page is not fetched.
Anonymous preview vs signed-in scan
Anyone can run a short public preview: SEO and AI-visibility checks, fewer pages, no active security testing. That preview is rate-limited per IP. Paid security scans run only after the backend verifies a paid entitlement. We do not treat client-supplied ownership or plan names as proof.
What we store
Account identity comes from Google or email sign-in. We store the URLs you scanned, the generated issues, Markdown reports, and billing state. Raw HTML is used in memory during the crawl and is not stored as its own field. Signed-in scans live in Redis for about seven days and may be archived to your account. Anonymous previews expire in about an hour and are not archived.
Email hello@siteory.co to delete account and scan data. Details live in privacy.
Security methodology
Siteory combines active application security analysis with external internet-exposure intelligence. Hermes analyzes the application. Shodan provides external exposure intelligence. Siteory correlates evidence and classifies findings separately from observations. This is not a guarantee of complete security coverage.
What we do not do
- We do not sell scan data
- We do not publish a public gallery of audited sites
- We do not use customer reports as unnamed case studies
- We do not ask for your CMS credentials
- We do not claim scans are 100% safe or zero risk
Product security findings
The in-product security audit is about the headers and exposures on your site. This page is about Siteory as a service. If you found a vulnerability in Siteory itself, email hello@siteory.co with enough detail to reproduce and do not share it publicly until we have had a chance to fix it.
Legal terms are in terms.