PollyX

Security

How PollyX protects your account and your data, and how to tell us about a problem.

Report a security problem

Found a way to see someone else's data, get around a sign-in or a payment, or make PollyX do something it should not? Write to contact@pollyx.org with the word Security in the subject. We reply within 48 hours, and we tell you when the problem is fixed.

What helps us fix it fast

The page or API address where it happens
The steps to make it happen again, one by one
What you could see or do that you should not have been able to

While you test, please

Use an account of your own, and stop as soon as you have shown the problem
Do not read, change or delete other people's data
Do not flood the site with requests or try to take it offline
Do not try to trick PollyX staff or customers
Give us a reasonable time to fix it before you tell anyone else

PollyX does not pay rewards for reports. The same contact, in the form security tools read, is at /.well-known/security.txt.

What protects you today

Encrypted connections only: Every page and every API call is served over HTTPS. Browsers are told to refuse an unencrypted connection to pollyx.org and its subdomains for two years.
Your card never reaches PollyX: Payments are taken on Stripe's and Link's own checkout pages. PollyX receives a confirmation of the payment, never your card number.
Your checks and reports are yours alone: The database refuses by default: an account can read only its own checks, reports, brands and settings, and that rule is enforced in the database itself, not only in the pages.
Your password and your API keys are not kept readable: Your password is stored only as a one-way hash by our sign-in provider. API keys and connector tokens are stored as hashes too. The application password you give PollyX for your WordPress site is encrypted before it is saved.
Staff access needs a second factor: A PollyX staff account cannot open any admin tool until it has passed two-factor sign-in with an authenticator app.
Your visitors' addresses stay with you: When you add a server log to see which AI crawlers visit your site, the log is read in your own browser. Only counts are sent to PollyX; the IP addresses in the file never leave your computer.
Sharing is yours to switch off: A shared report, check or brand page opens only with its own long random link. Turn sharing off and the link stops working at once. A person you invite to a brand reads it only when signed in with the address you invited, and removing them ends that at once.
Deleting means deleting: A report or check you delete waits 30 days in Recently deleted, in case it was a mistake, and is then erased. Deleting your account erases your data and cancels any plan first.

Where your data is, and who handles it

The privacy policy lists what PollyX stores, why, for how long, and the suppliers that process it. The help article Your data and privacy shows how to get a copy of your data or erase it.

Buying for a company that needs a security questionnaire filled in? Send it to contact@pollyx.org. Whether PollyX is working right now is on the status page.