Your data

Without an account

If you check without an account, we don’t create any record. Neither the address nor the result goes into our database. The result is sent to your browser and is gone when you close the page.

To prevent abuse of the check, the server counts how often checks come from your IP address. It keeps this counter in memory for at most one hour, not in the database. As with any web service, our host may keep technical access logs, which can also contain the address you checked. Details are in the privacy policy.

With an account

With an account, every check goes into your history, whether you check in the browser, through the API or through MCP with a key, or whether the weekly check runs. We store the address, grade, score, where the check came from and the full result. Only you can see the history.

For the weekly check, we store the addresses you have us monitor and their latest grade. For API keys we store only a fingerprint, not the key itself.

Keys we find

If we find an access key in your app, the result shows its type, where it was found and the value in shortened form, the beginning and the last characters, for example sk_live_…9f2A. Only this shortened form appears in the history. We never output, store or use the full value.

No public result pages

Results are never visible to others. There is no leaderboard, no searchable archive and no links search engines can find. Anyone who wants to know how a site performs has to check it themselves.

A public result would be a list of open doors that attackers could simply pick up. If you want to share your result, for example with your IT team or a service provider, pass it on yourself.

What the checked site sees

For the checked site, a check is a normal visit: one page request and the fetching of the JavaScript files the page includes, as with a browser. It identifies itself as HullwiseScanner/1.0 and comes from our server, not from your device. We don’t send any information about you along with it. What we do there and what we never do is described in What we don’t check.

Deleting your data

Email us at cem@cdcapital-group.com from the address of your account. We then delete your account and with it your history, your monitored addresses and your API keys.

Still have questions? Email us.