Security Practices

1. Overview

At FixiWeb, security is foundational to everything we build and operate. We are committed to protecting the confidentiality, integrity, and availability of your data and our platform. This document outlines the security practices, standards, and measures we employ to safeguard your information.

We continuously evaluate and improve our security posture to address evolving threats and meet the expectations of our customers. If you have any questions about our security practices, please do not hesitate to contact us.

2. Data Encryption

FixiWeb employs industry-standard encryption to protect your data at every stage:

• Encryption at Rest: All stored data is encrypted using AES-256 (Advanced Encryption Standard with 256-bit keys), one of the strongest encryption algorithms available and widely adopted across government and enterprise applications.
• Encryption in Transit: All data transmitted between your browser and our servers, as well as between internal service components, is protected using TLS 1.2 or higher (Transport Layer Security). This ensures that your data cannot be intercepted or tampered with during transmission.
• Key Management: Encryption keys are managed through secure key management systems with strict access controls and regular rotation policies.

3. SOC 2

FixiWeb is not SOC 2 certified today, and no SOC 2 report is available yet. We design our controls with the SOC 2 Trust Services Criteria in mind, and the measures described on this page are the ones in place now.

• Security reviews: If your organisation needs information for a vendor security review, contact us at security@fixiweb.ai.
• Updates: We will update this page if and when a formal audit is under way or completed.

4. GDPR and CCPA Compliance

FixiWeb is committed to compliance with global data protection regulations, including the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA).

Data Subject Rights

We respect and support the rights of data subjects under applicable privacy laws, including:

• Right of Access: You may request a copy of the personal data we hold about you.
• Right to Rectification: You may request that we correct any inaccurate or incomplete personal data.
• Right to Erasure: You may request the deletion of your personal data, subject to legal retention requirements.
• Right to Data Portability: You may request your data in a structured, commonly used, and machine-readable format.
• Right to Object: You may object to certain types of processing, including processing for direct marketing purposes.

Data Processing Agreement

A Data Processing Agreement (DPA) is available for customers who require one for GDPR compliance purposes. To request a DPA, please contact us at security@fixiweb.ai.

5. Infrastructure Security

FixiWeb leverages trusted, enterprise-grade infrastructure providers to ensure the security and reliability of our platform:

• MongoDB Atlas: Our database layer runs on MongoDB Atlas, which provides built-in encryption at rest and in transit, automated backups, network isolation, fine-grained access controls, and continuous monitoring. Atlas is SOC 2 Type II, ISO 27001, HIPAA, and PCI DSS compliant.
• Render Hosting: Our application services are hosted on Render, which provides managed infrastructure with automatic TLS certificates, private networking, and isolated runtime environments.
• Cloudflare DDoS Protection: All traffic to FixiWeb is routed through Cloudflare, which provides enterprise-grade DDoS mitigation, Web Application Firewall (WAF) capabilities, and global CDN for performance and availability.

6. Authentication and Access

FixiWeb implements robust authentication and access control mechanisms to protect user accounts and platform resources:

• JWT-Based Authentication: User sessions are managed using JSON Web Tokens (JWT) with short-lived access tokens and secure refresh token rotation to minimize the risk of session hijacking.
• Bcrypt Password Hashing: All user passwords are hashed using the bcrypt algorithm with a high work factor before storage. Plaintext passwords are never stored or logged.
• Role-Based Access Control: Access to platform features and data is governed by role-based access control (RBAC), ensuring that users can only access the resources appropriate to their role and subscription level.
• Internal Access Controls: Access to production systems and customer data by FixiWeb staff is restricted on a need-to-know basis, and the administrative interface is reachable only through an authenticated access gateway (Cloudflare Access).

7. AI Data Handling

FixiWeb uses artificial intelligence to analyze scan results and generate actionable recommendations. We take the handling of your data in this process seriously:

• Analysis Only: Scan data is processed by our AI systems solely for the purpose of identifying issues, generating recommendations, and producing reports for your benefit.
• No Model Training: Your scan data, website content, and personal information are never used to train, fine-tune, or improve AI or machine learning models. Your data remains yours.
• Data Minimization: We process only the minimum amount of data necessary to deliver accurate analysis results. How long each kind of scan data is kept - including records of scans run from our public landing page - is set out in our Privacy Policy.

8. Credential Handling

Applying a fix to your site requires access to your site, so FixiWeb does store the credentials you connect — encrypted. This section says exactly which ones, how they are protected, and how to remove them.

• Scanning: Our monitoring and scanning engine analyzes publicly accessible pages and resources without requiring any login credentials. If you only ever scan, FixiWeb never asks you for a credential and stores none.
• What we store to apply fixes: when you connect a site for automated fixes, we store what that platform's write path needs — a WordPress Application Password, a Wix OAuth client secret, a Shopify Admin API access token, a Webflow Site Token, a FixiWeb connector token, or (for the opt-in Computer Use Agent) your CMS sign-in username and password. Every secret is stored as AES-256-GCM ciphertext with a per-credential 32-byte salt and 16-byte initialization vector, under a key derived by PBKDF2-SHA512 (100,000 iterations) from a master key held in a Render Secret File — never in our source code and never in a database record.
• What is never stored: the plaintext of any credential. Secrets are decrypted in memory only at the moment a fix is executed and are never written to logs, error reports, support tickets, or analytics. We never see your payment card details — those go directly to Stripe. We do not ask for, and do not store, FTP credentials or SSH keys.
• How long we keep them: the CMS sign-in credentials for the opt-in Computer Use Agent expire automatically 30 days after they are last used. Platform API credentials are kept for as long as the site is connected, and are erased when you disconnect the site, replace the credential, or delete your account. You can delete any stored credential yourself at any time from the site's settings.
• Least privilege: we ask for the narrowest credential a platform offers — a revocable WordPress Application Password rather than your WordPress account password, and a scoped OAuth grant on Wix and Shopify. Revoking that credential on your platform immediately ends FixiWeb's access, with no action needed on our side.
• One approval, no silent expansion: approving FixiWeb on WordPress also lets it check for, switch on and connect its own plugin so repairs that need it can run — and nothing more. It never installs software through that approval, each setup action is recorded and shown to you, and anything WordPress would need you to grant beyond it is asked of you at the moment it is needed. Disconnect in Settings withdraws all of it together.

9. Third-Party Security

We carefully vet all third-party services integrated into the FixiWeb platform to ensure they meet our security standards:

• Stripe (Payment Processing): All payment processing is handled by Stripe, a PCI DSS Level 1 certified service provider, the highest level of certification in the payment card industry. FixiWeb does not store, process, or have access to your full credit card numbers. All payment data is handled directly by Stripe's secure infrastructure.
• Resend (Email Delivery): Transactional emails, including notifications, reports, and account communications, are delivered through Resend. Resend provides secure email delivery with TLS encryption and does not use your data for any purpose other than delivering messages on our behalf.

We regularly review the security posture and compliance certifications of our third-party providers to ensure they continue to meet our standards.

Incident Response

In the event of a security incident, FixiWeb follows a structured response process:

1. Triage and containment - identify scope, isolate affected systems
2. Investigation and mitigation - root cause analysis and remediation
3. User notification - notify affected users where appropriate
4. Regulatory notification - within 72 hours where required (GDPR)
5. Post-incident review - lessons learned and prevention measures

10. Responsible Disclosure

FixiWeb values the work of security researchers and the broader security community. If you discover a security vulnerability in our platform, we encourage you to report it responsibly.

How to Report

• Send your report to security@fixiweb.ai with a detailed description of the vulnerability, including steps to reproduce it and any relevant proof-of-concept materials.
• Please provide sufficient detail for us to understand and reproduce the issue.

Our Commitment

• Acknowledgment: We will acknowledge receipt of your report within 48 hours.
• Investigation: We will investigate the reported vulnerability promptly and keep you informed of our progress.
• No Retaliation: We will not take legal action against security researchers who report vulnerabilities in good faith and in compliance with this policy.
• Recognition: With your permission, we may publicly acknowledge your contribution to improving the security of our platform.

We ask that you refrain from publicly disclosing any vulnerability until we have had a reasonable opportunity to address it.

11. Contact

If you have any questions about our security practices, need to report a security concern, or would like to request security documentation, please contact us:

• Security Team: security@fixiweb.ai
• Website: https://fixiweb.ai

By using FixiWeb, you acknowledge that you have read and understood our Security Practices.