Assurance

Trust Center

40T is an independent compliance-evidence platform, so we hold ourselves to the same standard we apply to the sites we scan: we publish our security and data posture exactly as it stands — including what is still in progress.

Security practices Sub-processors Scan-data handling Attestations

Security practices

How 40T protects the platform and the evidence it captures:

Encryption in transit: all traffic is served over HTTPS/TLS.
Encryption at rest: account data and scan evidence are stored in a managed Postgres database (Supabase) with encryption at rest.
Authentication: user accounts and sessions are handled by Clerk; admin surfaces require an additional, timing-safe secret on top of an authenticated session.
Payments: processed by Stripe — 40T never stores card numbers.
Least privilege: internal and service-to-service access is scoped and secret-gated.
Monitoring: errors and performance are monitored via Sentry.
Evidence integrity: scan findings are sealed with a SHA-256 hash so a report can be shown to be unmodified.
Read-only scanning: 40T observes public URLs from the outside; it does not log in, modify, or attack the sites it scans.

Report a security issue via our vulnerability disclosure policy.

Sub-processors

40T uses the following third-party sub-processors to operate the service. We keep this list current and will note material changes here.

Sub-processor	Purpose	Data handled	Region
Vercel	Application hosting & CDN	Request metadata, server logs	United States
Supabase	Database & file storage	Account data, scan results & evidence	United States
Clerk	Authentication & user management	Name, email, organization	United States
Stripe	Payment processing	Billing details (no card numbers stored by 40T)	United States / global
Sentry	Error & performance monitoring	Diagnostic events, IP address	United States
Railway	Scan-engine compute	Target URLs & scan telemetry	United States
Anthropic	AI model provider (tracker & AI classification)	Scan-derived content for classification	United States

Questions about sub-processors? Contact privacy@40tsecureai.com.

Scan-data handling

Anonymous discovery scans (the free scanner on our homepage) are processed in real time and are not stored; no personal data is collected beyond standard server logs.
Customer scans are stored in your organization's account for the duration of your subscription and are never shared with other customers.
What we capture is observable public behavior: requests, cookies, storage, consent signals and timing — sealed as evidence with a SHA-256 hash.
We do not sell scan data or personal data to third parties.

Full detail is in our Privacy Policy and Cookie Policy.

Attestation status

40T's security program is aligned with ISO/IEC 27001, and the platform undergoes independent third-party penetration testing. 40T also builds on infrastructure providers that maintain their own SOC 2 programs (Vercel, Supabase, Stripe), and applies the security controls described above.

For current attestation details and compliance documentation, contact privacy@40tsecureai.com. We keep this page current as our attestation posture evolves.

See it for yourself: 40T runs its own scanner against 40tsecure.ai — view our public self-scan.