Security and Data
Where SiteAccessible runs, what it stores, what the widget sends, and what we do not claim.
Last updated
This page summarises how SiteAccessible handles data. The binding texts are our Privacy Policy (siteaccessible.com/legal/privacy) and Data Processing Agreement (siteaccessible.com/legal/dpa); if anything here seems to differ from them, they prevail.
1. Who runs it
SiteAccessible is a product of QROLLING LLC, a limited liability company registered in Georgia under number B26345195, with its registered office at 75A Erosi Manjgaladze Street, Tbilisi 0159, Georgia.
2. Where it runs
- Application servers and database: Akamai Technologies (Linode), in the European Union (Frankfurt, Germany).
- In front of them: Cloudflare, for DNS, content delivery and protection against attacks.
- Payments: Paddle, our merchant of record. We never receive card numbers.
- Email: Google Workspace, for transactional email and our support mailboxes.
The full list of sub-processors, with what each one processes, is in Section 6 of the Privacy Policy.
3. What the widget sends us
| Sent | Stored |
|---|---|
| One page-load count per page view — always, for plan metering and install verification. | As a daily total per site. |
| Panel opens and which adjustment was switched on — only while the site keeps Usage analytics on. | As daily totals per site. No link to a person. |
| The visitor's IP address, as with any web request. | Not stored. A keyed hash is held in server memory for at most 24 hours, to count a page view once and limit abuse. |
The widget sets no cookie and creates no identifier. A visitor's own settings stay in their browser's local storage and are never sent to us.
4. How accounts are protected
- TLS on every connection between browsers and our servers.
- Passwords stored as salted bcrypt hashes; one-time codes as keyed hashes, valid for ten minutes.
- Session cookies that scripts cannot read (HttpOnly); changing or resetting a password ends every existing session.
- Staff sign-ins confirmed with a one-time code sent by email.
- Each customer can reach only their own sites; the database is not reachable from the internet.
5. Your data
- We keep your account, your sites and their usage data for as long as your account exists.
- You can download your data and delete your account yourself, in the panel's account settings; deletion is immediate. If you ask us to delete it instead, we do so within 30 days.
- Billing records are kept as long as tax and accounting law requires.
6. Data processing agreement
Our Data Processing Agreement applies to every customer on every plan, automatically. If your organisation needs a countersigned copy, write to [email protected].
7. What we do not claim
- We hold no security certification such as ISO 27001 or SOC 2.
- We do not publish a VPAT (Voluntary Product Accessibility Template) yet; our own accessibility statement is at /legal/accessibility.
- We do not offer an uptime guarantee or a service-level agreement; Section 2.6 of the Terms explains this.
8. Reporting a problem
If you think you have found a security vulnerability or a data-protection issue, write to [email protected]. Please give us a reasonable time to fix it before telling anyone else. If a personal-data breach affects you, we will tell you and the competent authorities as the law and our DPA require — customers within 72 hours of our becoming aware of it.
QROLLING LLC · 75A Erosi Manjgaladze Street, Tbilisi 0159, Georgia