Security

If you’ve found a security problem in Pixel Sentinel, please tell us before telling anyone else. Email support@pixelsentinel.net with Security in the subject line, and include:

• what you found and where (the address, and the account or image ID if one is involved);
• the steps to reproduce it;
• what an attacker could do with it.

We read every report, and we’ll tell you what we find and when it’s fixed. We don’t run a paid bug bounty.

• Use your own account and your own images.
• Don’t read, change or delete other customers’ data. If you reach some by accident, stop and tell us.
• Don’t flood the service, send spam, or use social engineering on our staff or customers.
• Give us reasonable time to fix a problem before you publish it.

The dashboard and API at pixelsentinel.net, and image delivery at argus.pixelsentinel.net.

Some things are known limits, not vulnerabilities: screenshots, removing the invisible watermark, and a script that imitates a visitor on an approved site. They’re described on What it can and can’t do. Problems in the services we rely on, such as Stripe, Zoho or Google sign-in, should go to those companies.

• Encrypted connections. All traffic uses HTTPS.
• Scrambled storage. We store only the scrambled version of each image, in private storage that only our server can reach. We never keep your original file, only the scrambled version and a small encrypted thumbnail.
• Encrypted keys. The key that scrambles your images is stored encrypted.
• No card data. Payments go through Stripe. We never see or store card numbers.
• Sign in with Google, Microsoft, Facebook or Pinterest, and we hold no password for your account. If you sign in with an email address and password instead, we store only a salted scrypt hash of it. We never hold your scramble password.
• Limited staff access. Staff see a small preview of an image only when it has been flagged or reported, and every look is logged.
• Backups of account data are continuous, and deleted data leaves them within 30 days.

We hold no security certifications such as SOC 2 or ISO 27001. See the Acceptable Use Policy for the kinds of data Pixel Sentinel shouldn’t be used for, and the Privacy Policy for what we collect and keep.

If a security incident affects your data, we’ll tell you, and the authorities where the law requires it. Current problems with the service are shown on the status page.