# Security

> How we protect your domain, your data and your certificate, and the limits we put on what software and AI agents can do.

A mark certificate represents your brand in millions of inboxes. We treat every step that could affect it with care.

## Proving it's really you

- **Domain control.** Before we order, reissue or revoke a certificate, you prove you control the domain by adding a unique [ownership record](https://getverifiedinbox.com/docs/glossary.md#domain-ownership). If that record disappears later, we notice.
- **Authority.** The applicant must be allowed to act for the company: confirmed by an email address at your domain, or by your attestation, and then verified by the certificate issuer.
- **Business verification.** We check your company against official registries before the issuer does its own checks.

## Private by default

- Knowing a domain gives no one access to its application. Only the person who started it (in their browser or with their private guest token), members of the owning organization and our operators can see it. Anyone else gets "not found", so we never even confirm an application exists.
- Free checks only read public information and never reveal anything about existing applications.
- Links you share point to steps, never to credentials. One-time resume links keep their secret in the part of the URL that browsers don't send to servers, expire after 24 hours and work once.

## Organizations stay separate

Every query is scoped to your organization and environment (live or test). API keys and AI-assistant sessions carry explicit permissions (scopes), so a read-only key can't change anything.

## Limits on software and AI agents

- **Agents can't pay.** They can create a checkout link; only a person can complete payment on Stripe's page.
- **No DNS changes on your behalf** in this release; you add records yourself, and we never ask for your DNS login.
- **Revocation requires an explicit confirmation** and a dedicated permission.
- **Idempotency.** Payments, certificate orders and retries are protected against accidental duplicates.

## Safe handling of files and links

- Uploaded SVG logos are size-limited, checked, never rendered directly inside our pages and served with strict security headers.
- Links you give us are fetched through a protected fetcher that only reaches public internet addresses, with size and time limits.

## Abuse protection

Anonymous use is rate-limited, and expensive work (trademark searches, AI image comparison, automated browsing) has budgets, so the free tools stay fast for everyone.

## Secrets

Our own credentials are kept out of code and stored as protected configuration. We don't store your DNS provider credentials.

## Reporting a problem

If you think you've found a security issue, email [support@getverifiedinbox.com](mailto:support@getverifiedinbox.com) with the details. We'll respond quickly.