Security & trust

Procurement-grade reference. Last reviewed 2026-10-04.

Wrendex audits your site’s technical SEO posture. Doing that well means we look at every page on your origin, store crawl results, and email or page on-call when a regression appears. This page describes how we handle your data, how we authenticate access, who our sub-processors are, and how to report a vulnerability.

Frameworks & certifications

GDPR compliant

We process customer-controller data as a processor. Our Data Processing Addendum is available at /legal/dpa. All customer data, including EU-resident data, is hosted exclusively in the EU.

CCPA compliant

California residents have the right to access, correct, and delete personal information we hold; see /legal/privacy. We do not sell personal information.

DPA template on request

A pre-signed DPA based on the EU Standard Contractual Clauses is available at /legal/dpa. We will counter-sign a customer’s DPA on request, subject to legal review.

What we collect, how it’s stored

What we collect

URLs you ask us to audit, plus the HTML, headers, and resource list returned by each crawl.
Account information: email, name, workspace name, billing details (handled by Stripe).
Audit metadata: schedules, alert rules, share-link grants, member roles.
Telemetry: high-level usage events from the marketing site and dashboard, used to improve the product.

How it’s stored

At rest: Full disk encryption (LUKS) on every server, so the database and logs are encrypted on disk. Stored script and stylesheet bodies live in Wasabi object storage, which encrypts at rest.
In transit: TLS 1.2 or 1.3 on every public surface; older protocols are refused.
Region: EU only: servers at Hetzner in Helsinki, Finland, and object storage in Wasabi’s EU region (Amsterdam, Netherlands). There is no US or APAC region today.
Retention: Crawl history is kept up to your tier’s storage allowance (Free 500 MB, Studio 5 GB, Agency 50 GB). Past it, the oldest runs are pruned first; each site’s newest runs and anything from the last 7 days are always kept.

Sign-in & access

Sessions: Server-side sessions that expire after 7 days. Logout revokes the session immediately.
2FA: TOTP authenticator-app 2FA on every plan, with single-use backup codes on enrolment.
SAML SSO: Available on every tier. Tested with Okta, Azure AD, and Google Workspace.
API tokens: Per-user, scoped, revocable, audited. Tokens are stored hashed; the plaintext is shown once at creation.
Audit log: Each workspace logs invites, member and role changes, ownership transfers, site and alert-channel changes, SSO configuration, and account deletion.

Third parties that touch customer data

Stripe (billing), Hetzner (hosting), Wasabi (object storage), Mailgun (transactional email). Our complete and current sub-processor list, including processing purpose and data region, lives at /legal/sub-processors.

Reporting a security issue

We take security reports seriously. If you believe you’ve found a vulnerability in any Wrendex product or surface, please contact us privately first. We commit to:

Acknowledging your report within two business days.
Investigating and providing a meaningful update within seven business days.
Coordinating a public disclosure within a 90-day window after a fix has shipped.
Crediting you in the release notes (or omitting your name on request).

Contact

Email: click to show.