Security
How we protect customer data and the process for reporting security issues to us.
Last updated: 6/9/2026
Reporting a Vulnerability
- If you believe you've found a security issue in ValidateThat — the web app, our API, or the Figma plugin — please email security@validatethat.io (you can also reach us at support@validatethat.io if you don't have an account for the security alias).
- We aim to acknowledge reports within 24–48 hours. Critical issues are triaged and patched ahead of any public disclosure; lower-severity issues are scheduled into the normal release cycle.
- We follow coordinated-disclosure norms: reporters are credited (with permission), fixes ship first, public write-ups happen after users have had time to update.
- We do not currently run a paid bug bounty program. We do recognize researchers publicly and have a small thank-you for valid reports.
Scope
- In scope: validatethat.io and all subdomains, our API at validatethat.io/api/*, the ValidateThat Figma plugin (id: 1646135071566424895), and the embedded participant-study runner.
- Out of scope: third-party services we use (Stripe, Resend, Vercel, Upstash) — report those directly to the relevant vendor. Social engineering, physical attacks, and DDoS testing are also out of scope.
- Please do not test against participant accounts you do not own, or run automated scanning that creates load on production. We're a small operation and aggressive scans get noticed.
Infrastructure
- Application hosting: Vercel (SOC 2 Type 2, ISO 27001).
- Database / cache: Upstash Redis (SOC 2 Type 2). Data at rest is encrypted by Upstash; we do not store unencrypted exports outside the database.
- Email: Resend, used for transactional sends and broadcasts.
- Payments: Stripe (PCI DSS Level 1). ValidateThat does not store card or banking data; all payment data flows directly between the user and Stripe.
- All traffic to validatethat.io is TLS 1.2+ enforced. HTTP requests redirect to HTTPS automatically.
Account Authentication
- User sessions: HTTP-only secure cookies, scoped to validatethat.io and subdomains.
- Passwords: stored as bcrypt hashes. Plain-text passwords are never written to logs, the database, or any persistent store.
- Password reset: time-limited single-use tokens delivered via email.
- API tokens (used by the Figma plugin and any future integrations): generated server-side from 32 bytes of CSPRNG entropy, shown to the user exactly once at creation, and stored server-side only as a SHA-256 hash. The raw token is never persisted on our servers and is only ever transmitted over HTTPS as a Bearer header.
Figma Plugin Data Handling
- The plugin reads text from the frame you explicitly select in Figma, only when you run the plugin. It does not access other frames, pages, or files in your design.
- Card labels, the study title, and any categories you choose to send are transmitted over HTTPS to validatethat.io to create a card-sort study in your account. No Figma file content is stored beyond what you submit.
- Authentication uses a per-user API token, stored locally in Figma's clientStorage (scoped to this plugin only) and on our servers as a SHA-256 hash. You can revoke any token instantly from Settings → Integrations.
- The plugin transmits no data to Figma, Anthropic, analytics services, or any third party other than ValidateThat. No tracking is added by the plugin.
Accreditations
- ValidateThat is operated by a solo developer and is not separately accredited to SOC 2, ISO 27001, or HITRUST.
- Where we depend on certified infrastructure, those certifications are listed above (Vercel: SOC 2 Type 2 + ISO 27001; Upstash: SOC 2 Type 2; Stripe: PCI DSS Level 1).
- If you're conducting enterprise due-diligence and need additional documentation beyond what's on this page, contact security@validatethat.io and we'll do our best to provide what we can.
Reporting a security issue?
Email security@validatethat.io. Acknowledged within 24–48 hours. PGP not required.