Security

Infrastructure

Inclusivio runs on managed infrastructure from Vercel, Convex, and Amazon Web Services, whose platforms maintain independent security attestations such as SOC 2 Type II. We do not operate our own data centers.

Data protection

• All traffic is encrypted in transit with TLS. Data is encrypted at rest by our storage providers.
• Scans, results, and reports are scoped to an organization and accessible only to its members.
• Card data is handled by Stripe, which is PCI DSS Level 1 certified; it never touches our servers.
• Guest scan results stay in the visitor's browser, and guest previews expire from our cache after about one hour.
• AI providers receive only the page context needed for a request, under terms that exclude training on our customers' data.

Access and authentication

Sign-in is handled by WorkOS, with support for single sign-on and organization-level access. Production access is limited to staff who need it, and secrets are stored in our hosting providers' encrypted environment configuration.

Scanning safely

Pages are loaded in isolated, short-lived headless browser sessions. Scans read pages; they do not submit forms or change the sites being tested.

Responsible disclosure

If you believe you have found a security vulnerability, email contact@thea11ylabs.com with details and steps to reproduce. Please give us reasonable time to fix it before disclosing it publicly, and do not access other users' data, degrade the Service, or use social engineering. We will not pursue legal action against good-faith research that follows these guidelines.

Security questionnaires

Customers and prospects can request security documentation or a completed questionnaire at contact@thea11ylabs.com.