Data security
Keeping information from being accessed, altered, or destroyed by anyone who should not be able to. Encryption, access control, backups, monitoring.
Free Data Security Check
Know what your website
already exposes
A free external security check of your site or customer portal. We look at what it shows the public, run the analysis, and email you a written report - severity-rated, in plain language.
No software to installNo credentials neededWritten report by emailNo obligation
The foundations
What business data security actually means
Most companies think about it one layer too late - asking whether the database is encrypted, when the real question is whether a spreadsheet export is sitting in a public folder on the marketing site.
Data privacy
What you are allowed to collect and do with information about people, whether or not it is secure. Consent, purpose, retention, disclosure.
Data compliance
Proving both of the above to a regulator, an auditor, or an enterprise customer's procurement team. Evidence, documentation, review records.
Why SMBs are targeted
Automated scanning does not care how big you are. A small company with an unpatched plugin is a faster result than a bank with a dedicated security team.
Consequence vs likelihood
A larger organisation absorbs an incident. For a smaller one: customer notification, legal review, lost enterprise deals, and weeks rebuilding trust.
The gap that matters
Data does not leak because attackers are sophisticated. It leaks because something ordinary was left reachable - and nobody looked.
12 check areas
What the free security check looks at
All observable from outside your systems. Each finding in your report maps back to one of these areas.
Encryption in transitCertificates & HTTPSTLS versions, cipher suites, HSTS enforcement, mixed content, and pages still reachable over plain HTTP.
Browser defencesSecurity headersCSP, X-Content-Type-Options, Referrer-Policy, Permissions-Policy. Missing headers turn a small injection into a stolen session.
ExposurePublic files & endpointsExposed .env and .git directories, database dumps, backup archives, open directory listings, and admin panels on the open internet.
IdentityLogin & session handlingMFA availability, session cookie flags, login flows that leak account existence, and rate limiting on authentication.
Access controlWho can reach your dataUnauthenticated API endpoints, file stores reachable without login, predictable record IDs in URLs, and public cloud buckets.
LeakagePersonal data in the wrong placeForms over HTTP, identifiers in URLs and referrer headers, customer data in client-side JS, and records in sitemaps.
Third partiesScripts, pixels & tag sprawlEverything executing on your pages, what each one can read, subresource integrity, and vendors receiving undisclosed data.
ConsentCookies & compliance signalsNon-essential cookies before consent, cookie lifetimes, and whether your policy matches your site's actual behaviour.
ImpersonationEmail & domain spoofingSPF, DKIM and DMARC enforcement, look-alike domain registrations, and dangling DNS entries.
Known issuesOutdated componentsDetectable CMS, framework, plugin and library versions matched against public vulnerability advisories.
PerimeterInfrastructure hygieneServices exposed externally, dev environments alongside production, DNS configuration, and version headers.
ResilienceBackup & recovery readinessA short questionnaire on backup frequency, restore testing, retention periods, and audit logging - these cannot be observed externally.
Third partiesScripts, pixels & tag sprawlEverything executing on your pages, what each one can read, subresource integrity, and vendors receiving undisclosed data.
ConsentCookies & compliance signalsNon-essential cookies before consent, cookie lifetimes, and whether your policy matches your site's actual behaviour.
ImpersonationEmail & domain spoofingSPF, DKIM and DMARC enforcement, look-alike domain registrations, and dangling DNS entries.
Known issuesOutdated componentsDetectable CMS, framework, plugin and library versions matched against public vulnerability advisories.
PerimeterInfrastructure hygieneServices exposed externally, dev environments alongside production, DNS configuration, and version headers.
ResilienceBackup & recovery readinessA short questionnaire on backup frequency, restore testing, retention periods, and audit logging - these cannot be observed externally.
Root causes
Where business data actually leaks
None of these require a skilled attacker. All of them are visible from outside - which is exactly why a free external check finds them.
Files nobody meant to publish
Database exports, invoice archives, customer lists, and config files with live credentials placed in a web folder during a migration - then forgotten. Search engines index them within days.
Old environments left running
A staging site, a legacy subdomain, an abandoned campaign install. Outdated software, often holding a copy of real production data, almost never monitored.
Access that was never revoked
Former staff accounts, shared admin logins, API keys committed to a repository, and integrations with far more permissions than they need.
Third-party scripts over-collecting
Analytics, chat widgets, heatmaps, and tag managers execute with full page access. On a checkout page that can include form contents.
Data in transit and in URLs
Forms over plain HTTP, personal identifiers as query parameters landing in server logs, browser history, and third-party referrer headers.
Email domains anyone can spoof
Without enforced DMARC, an attacker sends convincing invoices that appear from your domain. The damage happens entirely outside your systems.
People under time pressure
A reused password, a convincing login page, an urgent request approved without a second check. Controls decide how much one mistake costs - not whether mistakes happen.
The process
How the free check works
Three steps. No installation, no credentials, no access to your systems. A person reviews the output before it reaches you.
Submit your address
Enter your website or portal URL and a work email. We confirm domain ownership before anything runs - no check starts without that verification.
We run the external check
Automated tooling collects evidence across the 12 areas. An analyst then reviews the output, removes false positives, and rates findings by actual data exposure risk.
You receive a written report
Each finding arrives with its severity, the evidence we observed, what it means for your data in plain language, and a suggested fix. Yours to act on, with or without us.
Report format
What your report looks like
Every finding is written so a non-specialist understands the risk and a developer can act on it the same day.
| Finding | Severity | What it means for your data | Suggested fix |
|---|---|---|---|
| Database backup at a public path | High | A complete copy of customer records downloadable by anyone who finds the filename. No login required. | Remove the file, move backups to private storage, block archive extensions at the web server. |
| Session cookie missing Secure + SameSite | High | A logged-in session can be captured on an untrusted network, giving an attacker the account without the password. | Set Secure, HttpOnly and SameSite=Lax on session cookies. Force HTTPS site-wide. |
| Staging environment publicly indexed | Medium | A second copy of the app - often with weaker credentials and real data - appearing in search results. | Restrict staging by IP or basic auth and remove indexed pages. |
| Marketing scripts fire before consent | Medium | Identifiers shared with third parties before visitors agree, conflicting with your published cookie policy. | Gate non-essential tags behind the consent banner. |
| DMARC set to monitor only | Medium | Your domain can be used in phishing aimed at customers and staff - messages still get delivered. | Review DMARC reports, then move to quarantine and on to reject. |
| Server version in response headers | Low | Tells an attacker exactly which software version to target. Shortens their reconnaissance. | Suppress version banners in the web server configuration. |
Illustrative extract only. The report also records what could not be checked and why.
How it compares
Security check, vulnerability scan, or pen test?
These are not the same purchase. Choosing the wrong one wastes budget or produces a report nobody can act on.
| Data security check | Vulnerability scan | Penetration test | |
|---|---|---|---|
| Question answered | What is my data exposed to right now? | Which known software vulnerabilities exist? | Could an attacker actually get in? |
| Access needed | None. External only. | Usually none, sometimes credentials. | Credentials, scope agreement, rules of engagement. |
| Human review | Analyst rates every finding. | Largely automated, high false-positive rate. | Fully manual, highly skilled. |
| Output | Prioritised findings in plain language. | A long technical list, often unfiltered. | Narrative of exploited paths and business impact. |
| Typical cost | Free to low. | Low, often subscription. | Significant, project-based. |
| Best starting point | Any business yet to assess data exposure. | Teams already patching regularly. | Mature products with a security programme. |
Security baseline
Business data security best practices
The working baseline we look for during a check - and the list your enterprise customers are asking about when they send a security questionnaire.
Know what data you hold
List every place customer and business data lives: databases, spreadsheets, shared drives, CRM, analytics, email, backups, contractor laptops. Record who owns each and how long it is kept.
Collect and keep less
Data you never collected cannot be breached. Review which form fields you genuinely use, set retention periods per type, and automate deletion. Data minimisation permanently reduces risk.
Encrypt in transit and at rest
HTTPS on every page - not just the homepage - with modern TLS and HSTS. Encryption at rest on databases, file storage, and backups. Keys managed separately from the data they protect.
Control access by role
Individual accounts, not shared logins. MFA on every admin, email, and cloud console. Revoke access the same day someone leaves. Quarterly review of who has access to what.
Separate environments
Staging and dev should never hold real customer data and should never be reachable without authentication. If you need realistic test data, mask or synthesise it.
Patch on a schedule
Track every CMS, framework, plugin, and library version. Subscribe to advisories. High severity within days, everything else monthly. Most exploited vulnerabilities had a fix available.
Test your backups
An untested backup is a belief, not a control. Restore to a clean environment on a schedule, time how long it takes, and keep at least one copy offline or immutable.
Log enough to reconstruct an incident
Authentication events, admin actions, permission changes, and data exports - retained long enough to answer what was accessed, by whom, and when.
Govern your third parties
List every vendor and script with data access, what each receives, and what your agreement says. Your customers' data is your responsibility even when it sits in someone else's system.
Reassess after every change
New integration, subdomain, developer, marketing tool, or platform migration each changes your exposure. Security is a state you maintain, not a project you complete.
By industry
Data security looks different in every sector
The data at stake determines what counts as a serious finding. Clarify Data works across four industry contexts.
Customer accounts, payment flows, order history
E-commerce & social media
Checkout pages carry the highest concentration of sensitive data and the most third-party scripts. Card skimming through a compromised tag is a persistent risk.
Explore industry →What we focus on
- Script integrity on checkout and account pages
- Order files exposed on public paths
- Consent before marketing pixels fire
- Account takeover resistance
Warning signals
Signs your data may already be exposed
Exposure is usually silent. Any one of these is a reason to run a check this week.
01
Emails that look like yours
Customers or staff receive messages that appear to come from your domain but were not sent by you - a direct sign of missing spoofing protection.
02
Unintended search results
Search results show pages you did not mean to publish: internal documents, staging pages, test accounts, or file listings.
03
No access inventory
Nobody can produce a current list of who has administrative access, or of which third-party tools run on your website.
04
Former staff still in systems
A previous employee or agency still appears in a system you have not audited since they left.
05
Unusual login activity
Login attempts spike against your admin or customer accounts, or support starts hearing about accounts behaving oddly.
06
Security questionnaire gaps
An enterprise prospect sends a security questionnaire and you cannot answer several sections honestly.
07
Unverified backups
Backups exist but have never been restored - so their contents and recovery time are both unknown.
08
Policy vs practice mismatch
Your privacy policy describes practices that no longer match the tools currently running on the site.
Our practice
How Clarify Data handles your data
You are about to tell a company where your weak points are. That deserves an explicit answer - not a badge in a footer.
| Practice | What it means in practice |
|---|---|
| Ownership verified first | We confirm the domain is yours before any check begins. We decline requests we cannot verify. |
| Passive by default | No exploitation, no credential guessing, no load testing, no changes to your systems. Anything active requires a separate written agreement. |
| Least privilege | If a paid engagement needs access, we ask for the narrowest scope that does the job - time-limited and revocable by you. |
| Named analysts only | Findings are visible only to the people working on your check, under confidentiality terms. |
| Encrypted in transit and at rest | Data moves over TLS and is stored encrypted. Keys managed separately. |
| Defined retention | Check evidence is deleted on a fixed schedule - and earlier on request. |
| Never sold or published | Your findings are not shared with third parties, used as marketing material, or named in case studies without written permission. |
| Human review where it matters | Uncertain or high-impact findings are escalated to an analyst before they reach your report. |
Processing is covered by our Privacy Policy and Data Processing Agreement.
Be clear-eyed
What a free check cannot tell you
No security assessment proves data cannot be breached. Being clear about the boundary is part of the report.
It sees the outside, not the inside
Logic flaws behind a login, permission errors between user roles, and insider misuse need authenticated testing.
It is a snapshot
A deployment tomorrow can reopen what was closed today. That is why monitoring exists as a separate service.
It does not cover your people
Most incidents begin with a convincing email, a reused password, or a well-meaning shortcut. Controls reduce damage; they do not remove cause.
It is not a legal opinion
We flag signals relevant to GDPR and CCPA. Compliance judgements remain with your counsel.
Common questions
Frequently asked questions
Is the data security check really free?
Yes. The initial check and the written report are free. No card required, no obligation afterwards. Paid work only begins if you ask for a proposal and accept a written scope.
Do you need access to my servers or admin accounts?
No. The free check is external and non-intrusive. It looks at what your site or portal already exposes publicly. Anything requiring credentials or active testing happens only under a separate written agreement.
Will the check slow down or damage my website?
No. The check is passive and rate-limited. It does not attempt exploitation, password guessing, load testing, or changes of any kind. It behaves like a careful visitor reading what is publicly available.
How long does it take to receive the report?
Reports are usually emailed within three business days of a submission being verified. Larger portals with many subdomains can take longer - we will tell you if that applies.
What does the report actually contain?
A list of findings, each with a severity rating, a plain-language explanation of what it means for your data, the evidence we observed, and a suggested fix. It also records what we could not check and why.
Who sees the findings about my site?
The report is sent to the email address you submit. Internally it is limited to the analysts working on your check. We do not publish findings, sell them, or share them with third parties.
Can I request a check for a site I do not own?
No. You must own the domain or have written authorisation from the owner. We verify ownership before running a check.
How often should a business run a data security check?
At minimum once a year, and after any significant change: a platform migration, new integration, new marketing tool, developer leaving, or new subdomain going live.
Does a data security check help with GDPR or CCPA compliance?
It supports compliance without replacing legal advice. The report flags observable signals relevant to those regimes - cookies before consent, undisclosed data sharing, personal data in URLs, and gaps between your published policy and actual site behaviour.
We already have HTTPS and a firewall. Is a check still useful?
Usually yes. HTTPS and a firewall do not prevent the most common causes of exposure: a backup file in a reachable folder, a staging environment with real data, or an API endpoint returning records without authentication.
How much do premium services cost?
Scope determines price, so we quote after the free report and a short call. What moves the number: estate size, number of environments and integrations, whether authenticated testing is needed, and whether the work is one-off or recurring.
What should we do first if the report finds something serious?
Stop the exposure before investigating it. If a file or endpoint is publicly reachable, remove or restrict access immediately, then preserve logs before they rotate. Rotate any credentials that appeared in the exposed material.
Start with one address
Request your free security report
Give us the address of the site or portal that holds your customer data. We verify ownership, run the check, and email you a written report - severity-rated, in plain language, with suggested fixes.
- Free - no card, no obligation
- Written report emailed within three business days
- Findings ranked by real data exposure risk
- An honest account of what we could not see
Prefer to talk first? Book a short call or contact the team.
Request your free report
One email, one address. We handle the rest.