Security and data

Last reviewed 12 October 2026.

How is my data secured?

• In transit: everything runs over HTTPS (certificates from Let's Encrypt). Requests from the connector plugin are also signed with a secret that only your store and Culpritly know, and a request older than five minutes is refused.
• Your connector secret is stored encrypted in our database and is shown to you once. You can generate a new one at any time and the old one stops working immediately.
• Passwords are stored as bcrypt hashes, at least 12 characters, and common passwords are refused (checked on our server; no password is sent to an outside service). Five wrong passwords lock that email and address for 15 minutes. Sessions use secure, HTTP-only, same-site cookies, are stored encrypted, are renewed at login, and every other device is logged out when you change your password. You can see and end your logged-in devices on your Security page.
• Two-factor login (authenticator app, with 8 one-time recovery codes) is available to every account and required for administrators. We email you when your password or two-factor settings change and when someone logs in from a browser or address we have not seen. Your Security page lists recent account activity.
• Web security: strict security headers (HSTS, Content-Security-Policy with no third-party hosts, frame blocking). We load no analytics, fonts, scripts or images from other companies. Contact details for security reports: /.well-known/security.txt.
• Servers: the database and queue are not reachable from the internet; only the web server (ports 80 and 443) is, behind a host firewall. Server logins use SSH keys only (passwords and root login are off) with automatic blocking of repeated failures, and the operating system installs security updates automatically.
• Backups: the database is backed up every night, encrypted, and kept for 14 days, plus one copy per week for 4 weeks and one per month for 3 months. Restores are tested by a monthly drill.

What do you collect?

The connector sends only what is needed to tell you what changed and what broke:

• Plugin, theme and WordPress updates, installs and activations (names and versions), and whether each plugin updates automatically.
• Which settings changed (the setting's name only, never its value).
• PHP fatal error messages and JavaScript error messages from checkout and payment pages, with file paths made relative to your site (email addresses are removed).
• For each order: an order number, the total, currency, payment gateway and status. Once, when you connect: the number of paid orders and their total for each of the last 60 days.
• Your WordPress, WooCommerce and PHP versions, your plugin list, your checkout type and your enabled payment gateways.
• Whether your home page responds, and how fast (measured from our server).

The connector does not send customer names, email addresses, postal addresses, phone numbers, IP addresses, the products in an order, card or payment details, setting values or API keys. Your own account details (name, email, hashed password) are stored so you can log in.

One thing to know: error messages are text written by plugins on your site. The connector removes email addresses and trims length, but it cannot know every shape of text a plugin might put in an error message.

What stack do you use?

The hosted service is a Laravel (PHP 8.3) application with PostgreSQL and Redis, run in Docker containers behind a Caddy web server, on a Google Cloud virtual machine in the United States (Iowa, us-central1). The connector is a WordPress plugin. Incident explanations use Anthropic's Claude API, email goes out through ZeptoMail, and subscriptions are handled by Lemon Squeezy.

Who can see my data?

• You, and anyone you share your login with. Another customer cannot open your stores.
• Culpritly's operator (currently one person, Faisal Alvi) has administrator access to the service and its server and can see every store's data.
• Service providers that process data for us: Google Cloud (hosting), ZeptoMail (email, so alert emails pass through it), Lemon Squeezy (payments; we never see card numbers) and Anthropic (AI analysis, below).

What goes to the AI provider: when an incident's likely cause is a plugin update, Culpritly sends Anthropic the incident type and counts, the error messages and script paths, recent change events (plugin names and versions, setting names), your plugin list with versions, your checkout type and gateway names, the number of paid orders around the incident, and the public code and changelog of the plugin from WordPress.org. It does not send your store's name or address, your email, order details, secrets or credentials. Anthropic states that API inputs and outputs are automatically deleted from its systems within 30 days, with exceptions for legal and policy enforcement.

Can I delete my data?

Yes. You can delete a store from its setup page, or your whole account from the Account page. That deletes the store records, events, incidents, alerts, AI analyses and response time history from our database. Copies in our encrypted backups disappear when those backups expire, within about 3 months. Raw events are in any case deleted automatically after 90 days. Payment records stay with Lemon Squeezy under its own terms. To stop the connector sending, deactivate and delete the plugin in WordPress; it removes its own data from your site. You can also ask us at hello@faisalalvi.com.

What is not done yet

• No independent security certification (such as SOC 2) and no third-party penetration test.
• No formal data processing agreement yet; one is planned before early access ends.
• One server in one region, with backups held on the same server for now. There is no automatic failover.
• Two-factor login is optional for customers (encouraged, not required).

Report a problem

Found a vulnerability or something that looks wrong? Email hello@faisalalvi.com. We will reply as soon as we can and tell you what we find.