Security
Reporting a vulnerability
Found a bug that puts users at risk? Write to hello@anyutil.io with a subject line starting with the word “security”. We confirm receipt within 72 hours and keep you posted on the fix.
Please go easy: test only on your own account, do not pull other people's data, do not run availability attacks, and hold off publishing until the bug is fixed or 90 days have passed. Stick to that and we will never take legal action against you. We do not pay bounties yet, but we are glad to credit you.
How we protect data
- Most tools never touch the server. The file stays in the browser, so it cannot leak from our side either. The full list is on where your data is processed.
- Encrypted connection. The whole site runs over HTTPS, with HSTS on and a redirect from the insecure version.
- Files on the server live for minutes. They are processed in memory and deleted the moment the result is sent back; they never reach a backup.
- Passwords. We store only a bcrypt hash, never the password itself. Not even we can read it.
- Payments. Entirely with Stripe. Card numbers never reach us and never pass through our server.
- Backups. The database is backed up before every deployment and the backups stay on a server in Germany.
- Rate limiting. Sign-in, sign-up and password reset all cap the number of attempts, which stops password guessing.
What we do not have
We hold no ISO 27001 or SOC 2 certification and we do not claim to. There is no independent penetration test either. The service is run by one person, which means quick fixes but no round-the-clock shift: reports are handled in working hours.
Two-factor authentication
Not offered yet. Until it is, use a long unique password from a password manager; you can generate one in the password generator, which runs entirely in your browser.
Related
Where your data is processed · Data processing agreement · Privacy policy