Security
This page describes how Check Your Website protects your account, your website data, and your code when Autopilot works on it. It describes what the service does today. It is run by an EU company, SOMA44 d.o.o. in Slovenia.
How Autopilot works
- Autopilot only opens a pull request or a Lovable change. You approve every change.
- You approve the plan before Autopilot changes any file. Autopilot never merges a pull request and never publishes a Lovable change.
- Autopilot works in an isolated cloud sandbox at Anthropic (Claude Managed Agents). The sandbox holds none of our keys. Its network reaches package registries and the repository or Lovable project you connected, nothing else.
- On GitHub, the sandbox gets a token that can only read the one repository you connected. The agent cannot push. It sends its changes to our backend.
- Our backend checks the changes first. If they touch dependencies, lockfiles, CI or build files, environment files, keys, a Dockerfile, or package scripts, nothing is written and those items are marked as not changed.
- Only then does our backend write the changes to a new branch, with a write token that it revokes right after, and open the pull request. The commit message carries [skip ci], so GitHub Actions does not run on the branch.
- Your hosting (for example Vercel or Netlify) may still build a preview of that branch before you review it. The pull request says so. Nothing reaches your live site until you merge.
- On Lovable, the same check runs on the change before you can publish it. Only you can publish, in the app.
- When the fix job ends, we delete the session at Anthropic, including the copy of your code in it.
Data we store and for how long
| Data | How long we keep it |
|---|---|
| Your account, websites, checks, and confirmed facts | Until you delete them or your account |
| Autopilot plans, summaries, and your feedback | Until you delete the website or your account |
| Code changes (diffs) Autopilot made | 90 days after the fix job ends |
| Autopilot session at Anthropic (code, commands, agent output) | Deleted when the fix job ends |
| Unfinished sign-ups and free trial links | 30 days after they expire |
| Messages to the assistant on our website | 30 days; the IP address is stored only as a hash that changes every day |
| GitHub event deliveries (webhooks) | 30 days |
| Report links sent by email | 12 months; if you claimed the report, we delete the email address and first name and keep the link to your account |
| Hash of your email address for beta credits and invites | Also after you delete your account, so credits are given once per mailbox |
You can download your data from your account settings at any time. Deleting your account deletes the data above, except the email hash, and disconnects GitHub and Lovable.
Encryption and access control
- Encrypted in transit (TLS) and at rest (database and backups).
- Every request for your data checks that it belongs to your account.
- Links that open a report or trial without sign-in are looked up by their SHA-256 hash. The link itself is stored only encrypted, so a copy of the database alone cannot open them.
- Our backend accepts requests only through our own website, apart from signed webhooks and our own internal services. Public links have rate limits.
- GitHub events are accepted only with a valid signature.
Agent API keys
- If you connect your own coding agent, such as Claude Code, Codex, or Cursor, it signs in with an API key. The key works for your whole account and can do what you can do in the app.
- We show the key once. Our database stores only a SHA-256 hash of it and its first characters, never the key itself.
- You can revoke a key in your settings. It stops working at once, with no delay.
- A key cannot delete your account or a website, create another key, create a developer link, or publish a Lovable change. Those actions need you, signed in.
AI providers and zero data retention
AI providers process requests with zero data retention and do not train on your data, except in the cases listed below. We call models through Vercel AI Gateway, which sets both on every request.
- Exception: Claude Managed Agents, where Autopilot works, does not support zero data retention. We delete each session at Anthropic when the fix job ends.
- Exception: no provider offers Perplexity Sonar with zero data retention. Sonar only answers public questions about your public page in the AI test, its answer is shown but not scored, and it is called with no training on your data.
Who can access production
Only SOMA44 d.o.o. can access production systems and data.
Report a vulnerability
Email info@check-your-website.com with the affected URL, the steps to reproduce, and the impact you expect. We reply within 3 working days. Do not make the issue public until we have fixed it. Do not access, change, or delete data that is not yours while you test.
Incident response
If a security incident affects your personal data, we tell you within 48 hours after we become aware of it. We say what happened, which data it affects, and what we are doing. We notify the supervisory authority when the GDPR requires it.
Audits and certifications
- Penetration test: planned. We will publish the date and scope here when it is done.
- We do not hold SOC 2 or ISO 27001 certification.