Security

BreachTally holds very little that is sensitive: public filings, subscriber emails and API keys. Here is how each is handled.

What we store

Breach records are public government filings. About you we store an email address, your alert filters, delivery logs and, for paid plans, an API key and your Polar customer id. Card details never reach us: checkout and billing run on Polar, our merchant of record.

API keys

Keys are shown once, on your account page, right after activation or rotation. They are never sent by email and never placed in URLs we generate. Rotate a key at any time from the account page, the old key stops working immediately. CSV download links from the account page use a separate per-account token that can only read data, never change the account.

Transport and headers

Everything is served over HTTPS with HSTS. Every response carries a content security policy that forbids scripts, a nosniff header and a frame-ancestors restriction. The site runs no client-side JavaScript.

Infrastructure

Hosted on Cloudflare Workers with the database in Cloudflare D1, email through Resend, payments through Polar. Access to the production environment is limited to the operator, with API tokens scoped per service.

Reporting a vulnerability

Write to support@breachtally.com. You get an acknowledgement within one business day and a fix date within five. Please do not test against other people's accounts or run automated scanners against the alert endpoints.

Data about people in breaches

None. Filings name organizations, not the individuals affected, and we do not collect, store or publish any personal data from notice letters.