Security

Effective date: June 5, 2026 · Link‑Lite Data LLC

We take the security of your account and data seriously. This page summarizes the controls we use to protect Link Website Pro, our payment‑security (PCI) posture, and how to responsibly report a vulnerability.

1. Data protection

Encryption in transit: All traffic to the Service is served over HTTPS/TLS.
Authentication: Sign‑in is handled via Google OAuth; we do not store passwords. Sessions use secure, expiring tokens.
API keys: Agency API keys are stored only as salted SHA‑256 hashes — the raw key is shown once at creation and never stored in plaintext. Keys can be revoked at any time.
Access control: Data is scoped per account; administrative access is restricted and logged.
Least data: We collect only the data needed to run the Service (see the Privacy Policy).

2. Application & API security

Rate limiting and fair‑use controls on scanning and API endpoints.
Server‑side authorization checks on every request; API access requires a valid key.
Access logging for security monitoring and abuse investigation.
Dependencies and infrastructure are kept current with security updates.

3. Payment security & PCI compliance

Link Website Pro uses Stripe Checkout for all payments. Cardholder data is entered on Stripe‑hosted pages and is transmitted directly to Stripe — we never see, transmit, or store your full card details on our servers. Stripe is a PCI‑DSS Level 1 certified service provider, the highest level of payment security certification. This design keeps the vast majority of PCI‑DSS obligations with Stripe and minimizes our scope.

4. Availability & backups

We host on reputable cloud infrastructure and target the availability described in our SLA. Data is stored in managed databases with routine backups.

5. Sub‑processors

We rely on vetted providers (Stripe, Google, our AI provider, WHOIS/DNS data provider, and cloud hosting). Business customers can request our current list and a Data Processing Agreement.

6. Enterprise & procurement

For larger customers, we can provide a description of our security controls and a DPA on request. We are not currently SOC 2 Type II certified; we are happy to discuss security requirements for your procurement process — contact support@linklitepro.com.

7. Vulnerability Disclosure Policy

We welcome reports from security researchers. If you believe you have found a security vulnerability in Link Website Pro:

Email support@linklitepro.com with the subject line "Security" and include steps to reproduce, affected URLs, and any proof‑of‑concept.
Give us a reasonable time to investigate and remediate before public disclosure.
Do not access, modify, or delete data that is not yours; do not degrade the Service; and only test against your own account.
Do not run automated scanners or denial‑of‑service tests against our production systems.

We will acknowledge valid reports, keep you updated on remediation, and credit researchers who wish to be recognized. Good‑faith research conducted in accordance with this policy will not be pursued as a violation of our Terms.

8. Contact

Security questions or reports: support@linklitepro.com.