Security

How this website is built

These are properties of the site you are reading, and every one of them is verifiable from outside with a request and a look at the response headers.

• No third-party code. The Content-Security-Policy is default-src 'self' with script-src 'self' and style-src 'self' — no unsafe-inline anywhere. The site uses system fonts; there is no font service, no CDN, no tag manager and no analytics vendor.
• Framing and injection. frame-ancestors 'none', base-uri 'none', object-src 'none' and X-Content-Type-Options: nosniff.
• Transport. HTTPS only, with upgrade-insecure-requests and a strict-origin referrer policy.
• Forms. Antiforgery tokens on every post, rate limiting on the contact form and the administration login.
• Personal data at rest. IP addresses are stored only as salted SHA-256 hashes. Administration sessions use an HttpOnly, SameSite=Lax, secure-only cookie.

How the product handles your data

Scrubbing runs inside the SDK, before anything leaves your application, so sensitive values never reach ErrorDock at all. Passwords, tokens, payment details and request bodies are not collected by default; header and body capture is opt-in and allow-listed field by field.

Data and privacy has the detail, including where data is held, retention and DPA availability. API reference covers project keys and why an ingest key is write-only: telemetry keys can only send data, never read it.

What we do not claim

ErrorDock is in beta and run by a small team. We hold no SOC 2 report, no ISO 27001 certificate and no completed third-party penetration test. There is no bug bounty programme and no formal SLA.

Those will be stated here when they are true and not before. If your procurement process needs any of them, tell us what and by when — a straight answer about where something stands is more useful to you than a badge.