Security
WebValet holds credentials that can change your website. We treat that responsibility seriously and keep the attack surface small: no passwords, read-only Google scopes, encrypted tokens, and changes that are previewed, capped and reversible.
On this page
- The application runs on Cloudflare Workers at the edge, behind Cloudflare's network protection (DDoS mitigation, WAF, bot management, Turnstile on the free audit).
- The database is Cloudflare D1. Every query is scoped to the signed-in user in the application layer.
- Files (screenshots, PDFs) live in Cloudflare R2; the 7-day audit cache lives in Cloudflare KV.
- All traffic is HTTPS with HSTS. Data is encrypted at rest by Cloudflare.
- No passwords. Sign-in is Google OAuth handled by WebValet, so Google's protections (2-step verification, device checks) apply.
- Google Search Console and Analytics are connected with read-only scopes only.
- Refresh tokens and site credentials (WordPress, Cloudflare, Webflow, Shopify) are encrypted with AES-256-GCM; the key is a Cloudflare secret, never stored in the database or code.
- Access to production by the WebValet team requires hardware-key 2FA. There is no shared admin password.
- Only low-risk change types: titles, descriptions, alt text, structured data, llms.txt, redirects.
- Preview and approval before every change; daily caps per site; full before/after record; one-click undo.
- Credentials are scoped as narrowly as the platform allows (for example a Cloudflare API token limited to one zone).
Payments
Card data never touches WebValet. Checkout runs on Polar's PCI-compliant hosted page. We store a customer ID and the last four digits for display only.
- Dependencies are pinned and scanned; secrets live in Cloudflare's secret store, never in the repository.
- The crawler validates URLs, refuses private and internal addresses, follows at most three redirects and enforces timeouts.
- Logs exclude tokens and personal data beyond what is needed to debug.
- Backups: Cloudflare D1 point-in-time recovery (Time Travel) for the last 30 days.
If we discover a breach affecting your data we will contain it, assess it and notify affected users by email within 72 hours of confirming it, with what happened, what data was involved and what we are doing. Where the law requires, we notify the regulator in the same window.
If you find a vulnerability, email security@webvalet.app with steps to reproduce. We acknowledge within 2 business days, keep you updated, and credit you if you want. Please do not access other users' data, run automated scanners against production, or disrupt the service; we will not pursue researchers who act in good faith within these rules. Details are also at /.well-known/security.txt.