Security & Data Processing

1. Our approach

A11y Shield exists to help you meet a legal standard, so security is not a bolt-on — it shapes how the product is built. We keep the data we hold deliberately narrow, scope every request to a single organisation, and lean on managed infrastructure so we are not reinventing the hard parts of storage and encryption.

We want to set expectations plainly: A11y Shield is designed carefully but is not yet SOC 2 or ISO 27001 certified. What follows describes the controls that are actually in place today. Where a claim depends on a provider, we say so.

2. Infrastructure

A11y Shield runs on a small set of managed platforms, each chosen for a specific job:

• Database. Supabase Postgres, hosted in an EU region. This is the system of record for organisations, scans, results and leads.
• Application hosting. Vercel serves the web app and API.
• Scan worker. The website scanner runs in an isolated Fly.io worker — a separate, network-restricted service running headless Chrome with axe-core. It is deliberately kept apart from the application so that fetching untrusted third-party pages never happens inside our trusted app environment.

3. Encryption & secrets

All traffic to and from A11y Shield is encrypted in transit with TLS. Data at rest is encrypted by our infrastructure providers as part of their managed platforms.

Secrets — database credentials, API keys and signing values — are held in platform environment variables, never committed to source control. Calls between the scan worker and the application are authenticated with a shared secret compared in constant time to avoid timing attacks. In production this check fails closed: if the secret is missing or does not match, the request is rejected rather than allowed through.

4. Tenant isolation

A11y Shieldis multi-tenant, and keeping one organisation’s data away from another’s is our most important control. We enforce it in two independent layers:

• Application scoping.Every database query is scoped to the authenticated organisation’s id on the server side. Nothing is fetched without an org boundary.
• Database backstop.On top of that, Postgres Row-Level Security is deny-by-default: even if an application query were somehow missing its scope, the database itself will not return another tenant’s rows. The two layers are independent, so a mistake in one does not become a data leak.

5. Access control

Authentication is handled by Clerk. Access to the application is organisation-scoped, so users only ever see the data belonging to their own organisation. Internally we work on a least-privilege basis: administrative and infrastructure access is limited to what is needed to operate and support the service.

6. Scanner safety

The scanner fetches untrusted URLs, so it is built to be safe by design:

• It requests only the public pages of the URLs you submit. It does not sign in, and it stores no site credentials of any kind.
• It respects robots.txt.
• Its egress is guarded against Server-Side Request Forgery. The worker blocks requests to internal, cloud-metadata and loopback address ranges, and it pins DNS to the resolved IP for the duration of a fetch to prevent DNS-rebinding attacks that would otherwise let a hostname re-point to an internal address after passing checks.

7. Sub-processors

We rely on a short list of trusted sub-processors — including Clerk, Supabase, Stripe, Vercel and Fly.io — each processing data only on our instructions and under appropriate data-protection terms. The full, current list with purposes and regions is maintained in our Privacy Policy.

8. Certifications & assurance

We are honest about where we stand: A11y Shield is not yet SOC 2 or ISO 27001 certified. We are a young product and pursuing formal certification is on our roadmap rather than behind us.

In the meantime we are happy to support your own due diligence — we will complete reasonable security questionnaires and sign reasonable data processing agreements for business and agency customers.

9. Responsible disclosure

If you believe you have found a security vulnerability in A11y Shield, we want to hear from you. Email hello@lukeduff.co.uk with the subject line Security and enough detail for us to reproduce the issue.

We will not pursue or support legal action against researchers who act in good faith — who avoid privacy violations and service disruption, only interact with accounts they own or have permission to test, and give us reasonable time to investigate and fix an issue before disclosing it publicly. In return we will acknowledge your report and keep you updated.

10. Data Processing Addendum — summary

This section summarises the terms on which we process personal data on your behalf. It is a plain-English overview; a signed Data Processing Addendum (DPA) is available on request for business and agency customers, and the signed document governs in the event of any conflict.

Roles

For the scan data and personal data you submit through the service, you (the customer) are the data controller and Luke Duff, trading as lukeduff.co.uk is the data processor, acting on your documented instructions.

Scope & purpose

We process that data only to provide and support the A11y Shield service — running the scans you request, storing their results and producing the accessibility statements you ask for. We do not use your scan data for any unrelated purpose.

Confidentiality

Everyone with access to your data is bound by confidentiality obligations and access is limited on a need-to-know basis.

Sub-processors

We may engage the sub-processors listed in our Privacy Policy, each under data-protection terms no less protective than those in the DPA. We remain responsible to you for their performance.

International transfers

Our core database and scan worker are located in the EU. Where a sub-processor is outside the UK or EEA, transfers are protected by Standard Contractual Clauses (with the UK Addendum) or an applicable adequacy decision.

Assistance

Taking into account the nature of the processing, we will provide reasonable assistance with data-subject requests and with your obligations around personal-data breaches, including notifying you without undue delay of any breach affecting your data.

Deletion & return

On termination, and at your choice, we will delete or return the personal data we process on your behalf, and instruct our sub-processors to do the same, save where we are legally required to retain it.

11. Contact

Questions about our security posture, a questionnaire to send us, or a DPA to sign? Email hello@lukeduff.co.uk and a real person will reply.