Privacy

What we collect, and why.

Superlock exists to protect businesses, so we collect as little as we can and say exactly what. Questions: privacy@bizmax.io.

The free scan

• The domain you enter and the scan result, kept to cache results for ten minutes and to improve our checks.
• Your IP address is never stored. We keep a salted, truncated hash of it to rate-limit scans and spot abuse.
• If you join the early-access list: the email, domain, team size, plan interest and note you give us, used only to contact you about Superlock.

Superlock accounts

• You and your team: name, email, business name, role, hashed password, 2-step login settings, sign-in times and the browser identification string (user agent) of each active session.
• What you monitor: your domains, the results of each check (the last 60 per domain or connection), what changed, fixes, your risk decisions and readiness answers, and five-minute uptime checks (kept 31 days).
• Connected accounts: what we need to check security settings, such as user names and emails, admin roles, 2-step login status, last sign-in dates, mail-forwarding rules, connected apps, file names made public, payout account names with the last four digits, and store staff lists. We never read the content of email, documents or messages, and we don't store customer or order details beyond an order number or payment ID flagged as risky.
• Breach monitoring: your team's work addresses at domains you've verified, and the names of breaches they appear in.
• Your security log: a record of actions in your account, kept until you delete your business.

Who processes it

• Vercel (hosting) and Turso (database) run the service.
• Our email provider delivers alerts, reports, invitations and reset links.
• Have I Been Pwned receives team email addresses at verified domains, to look up breaches.
• Cloudflare and Google public DNS resolve the domain names we check; crt.sh and Cert Spotter receive domain names to read certificate logs; WordPress.org receives software version numbers.
• Anthropic processes your question and your own scan results when you use Ask Superlock.
• Stripe handles payments once paid plans start.
• Microsoft, Google, GitHub, Shopify, Stripe and Cloudflare receive our read-only requests when you connect them.
• Slack, Teams, Discord, Google Chat, Zapier and Make receive alerts if you add them as channels.

We don't sell data, and we don't use advertising or tracking cookies. The only cookie is your sign-in session. Our pages load fonts from Google Fonts.

Shared reports

A report link you create shows a frozen snapshot to anyone who has the link until it expires or you revoke it. It includes your domain and connection names, grades, the titles of open issues (some describe what we found in your accounts, such as "1 mailbox rule sends email to an outside address"), readiness, risk decisions with their reasons, and counts of people. It names no individuals, includes no email addresses and no detailed evidence.

Your choices

• Export: Settings → Your data → Download all data.
• Disconnect any connection at any time; its stored token is deleted.
• Delete: Settings → Delete everything removes your business and all its data immediately. Early-access list entries and free-scan records are deleted on request.

Superlock is a BizMax venture, in beta. Last updated 24 October 2026.