Get in touch

Contact

One address, read by a person — Email us.

Where to send what

About a specific audit

Send the report link or the address you scanned. If a finding looks wrong, say which card and what you see instead — reports are built from recorded evidence, so a disagreement is usually something we can check rather than argue about, and it is how several checks got fixed.

Accounts and billing

Email from the address on the account. We won’t discuss an account with anyone else, and we’ll never ask you for your password.

Security

If you’ve found a vulnerability, mail the same address with “security” in the subject and we’ll reply. Please don’t test against other people’s reports or accounts — tell us what you found and we’ll reproduce it ourselves.

Deleting your data

You don’t need to email us for that — the steps are here, along with what we store and for how long.

What to include, and when to expect a reply

One person reads this inbox, so a message that carries its own context gets a useful answer first time instead of a clarifying question. Whatever you are writing about, the report link is the single most useful thing you can paste: it identifies the account, the URL, the tier and the exact evidence the finding was built from, so nothing has to be reconstructed.

Expect a reply within one working day, usually sooner. The inbox is read from Europe (UTC+2), so a message sent late in the American evening is answered the following morning. There is no phone line and no chat widget: both would be answered by the same one person, more slowly and with less of the context this page asks you for.

If your question is about what a scan does to your server, how a check is scored, or what the free tier includes, the FAQ probably answers it already, and the methodology page explains how a score is arrived at. Neither needs an email.