Praised is a measurement service that reads the public web, so a first run needs a domain and nothing else — no tag on your site, no CMS credentials, no DNS record.
Last updated .
Access to your workspace
Every API request resolves to one workspace, and data access is scoped to it on the query, not filtered afterwards. A token for one workspace cannot read another's runs.
Passwords are stored only as PBKDF2-SHA256 hashes with a per-user salt. We cannot read your password, and neither can anyone who reaches the database.
API keys are stored as hashes too, shown once at creation, and revocable by you at any time.
Session and service tokens are audience-scoped: a token minted for one service is rejected by the others, so a leaked token has the smallest possible blast radius. A password reset or role change revokes every outstanding session — "sign out everywhere" is real, not cosmetic.
Single sign-on is self-serve, OIDC or SAML — your issuer, your certificate, your domain allowlist, configured in workspace settings without a sales conversation. Domain claims require a verified address at that domain, so nobody can route another company's logins.
Seats can be directory-managed: SCIM provisioning lets Okta or Entra create members and remove them the moment they leave the assignment list — deprovisioning cuts live sessions immediately.
Every sensitive change in a workspace — keys, SSO, members, connections — lands in an insert-only audit log its admins can read in Settings.
What our servers do on the internet
The product fetches other people's pages, which is exactly the capability an attacker would like to borrow. Every outbound fetch — the free checker, the crawler check, the site audit, your own webhook — goes through a guard that resolves the target first and refuses private, loopback and link-local addresses, redirects included. Public tools are rate-limited per IP with a daily ceiling, and the free tools run under a dedicated tenant so anonymous checks never land in a customer's history.
The APIs themselves are rate-limited too: authentication endpoints carry tight per-IP and per-account budgets, and every data endpoint is capped per credential — an unthrottled loop gets a clean 429 with a Retry-After, not a slow database.
Data at rest and in transit
All traffic is served over TLS.
Databases and backups are encrypted at rest by our hosting provider; every backup is verified before it is kept — its size is checked against a floor and its archive is parsed to confirm it actually contains table data, so a failed dump fails the job instead of quietly uploading an empty file behind a green tick.
Card details never touch our servers — checkout runs directly with Stripe.
Free-tool results expire; raw page-view rows are deleted after 90 days. See the privacy policy for the full retention table and the named list of every subprocessor.
Your data stays yours
Everything a workspace holds — runs, answers, settings, events — exports as JSON from workspace settings, self-serve, any time.
Closing a workspace is self-serve too. Removed products keep a 30-day grace window, then the data is hard-deleted on schedule rather than lingering because nobody got around to it.
Every product email carries its own unsubscribe, and bounces and complaints land on a suppression list that every send checks — there is exactly one mail path, so a suppressed address cannot be mailed by a side door.
What we do not claim
We are not certified against SOC 2 or ISO 27001 today, and we would rather say so plainly than imply a badge we do not have. If a certification is a procurement requirement for you, tell us and you will get a straight answer about the timeline instead of a maybe.
Reporting a vulnerability
Email hello@praised.co with enough detail to reproduce the issue. We acknowledge within two business days, keep you posted while we fix it, and will not threaten anyone who reports something in good faith.
No. Every API request resolves to one workspace, and data access is scoped to it on the query rather than filtered afterwards, so a token for one workspace cannot read another's runs. See Access to your workspace.
How do I get my data out?
Everything a workspace holds — runs, answers, settings and events — exports as JSON from workspace settings, self-serve, at any time. Closing a workspace is self-serve too. Removed products keep a 30-day grace window and are then hard-deleted on schedule. See Your data stays yours.
How do I report a vulnerability?
Email hello@praised.co with enough detail to reproduce the issue. We acknowledge within two business days, keep you posted while we fix it, and will not threaten anyone who reports something in good faith.