Security and data handling

We look only at what any visitor’s browser can see: your public pages, response headers, the TLS certificate, the scripts and libraries each page loads, and how quickly the server responds. Our crawler identifies itself in every request and respects robots.txt. How it works and how to block it.

• Attempt to sign in, guess credentials or submit your forms.
• Bypass a firewall, a bot challenge or a robots.txt rule.
• Load-test or penetration-test anything without your written authorisation and an agreed window.
• Contact your customers or staff, or use our findings for any purpose other than your survey.

For a deeper survey you can share slow-query logs or request timings. Files are compressed in your browser before upload. We keep totals, timings and the structure of each query with all literal values removed, so names, email addresses and account numbers never reach our database. The raw file is not retained, and any upload can be deleted on request.

Access beyond your public site is granted only under a signed agreement, and we will sign your NDA first if you use one. We request the least access the work requires, read-only wherever possible, issued to the named engineer who will use it, and we return it at the end of the engagement. Every administrative account we hold is protected by multi-factor authentication.

This site sends the security headers our survey checks for and sets no analytics or advertising cookies. You can watch it pass those checks in the live console on the home page. What the contact form collects is set out in our privacy notice.

If you find a security issue in anything we have built, email hello@tektonsystems.co.uk with the details. We acknowledge reports within one working day and keep you informed until the issue is resolved.