Trust you can verify.
How ScaleEdges protects your store, your customers and your payments. Every claim on this page is something that runs today, and the public ones you can test yourself in one click.
$ curl -sI https://scaleedges.com HTTP/2 200 strict-transport-security ✓ content-security-policy ✓ x-content-type-options ✓ x-frame-options ✓ referrer-policy ✓ permissions-policy ✓ cross-origin-opener-policy ✓
A+ where anyone
can check.
Security headers are instructions a site gives the browser: always use HTTPS, refuse injected scripts, don't let other sites frame the page. Two independent tools grade them.
- ScaleEdgesA+
- GumroadB
- ShopifyD
- PayhipF
Grades change whenever a platform updates its site, so run the test for today's result. A header grade is one useful signal, not a full security assessment.
Five layers,
so one slip isn't a breach.
- L1
Network
HTTPS enforced on every page with HSTS, traffic filtered by Cloudflare, and a strict Content Security Policy deciding which scripts a page may run.
- L2
Account
Two-factor codes or phishing-resistant passkeys (Face ID, Touch ID, Windows Hello, security keys). Repeated failed sign-ins are slowed down, and you can see and sign out every active device.
- L3
Sensitive actions
A separate security PIN guards customer exports, payout accounts, team changes and session sign-outs. Any payout account change also sends you an email.
- L4
Data
Stores are isolated, and a test of about 300 routes proves it before each release. Bulk reads of customer data raise alerts. Backups are encrypted, kept in France and restored daily to check they work.
- L5
End-to-end encryption
Private notes on followers and coaching clients are encrypted in your browser with a passphrase we never receive. ScaleEdges stores ciphertext only and cannot read them.
Someone steals your password.
Here is what happens next.
- Step 1
They try to sign in
The password alone isn't enough: they are asked for your two-factor code or your passkey.
Blocked - Step 2
They try to redirect your payouts
Changing the Stripe, Mollie or PayPal account asks for your security PIN, and you get an email either way.
PIN required - Step 3
They try to export your customers
Exports ask for the PIN too. Reading thousands of records quickly triggers an alert, and API access is cut off at abnormal volumes.
Flagged - Step 4
They open your private notes
Without your passphrase, they see the same thing our servers hold: unreadable ciphertext.
Encrypted
We never hold a card number.
Card details go straight from your customer to Stripe, Mollie or PayPal, all certified to the PCI DSS card-security standard. ScaleEdges receives only the payment result. Uploaded files are identified from their content, not their name, and executables are refused as products.
No badge we
haven't earned.
What is live, what is planned, and what we don't claim.
How personal data is used and protected is explained in plain language in our privacy policy.
Found a vulnerability?
Tell us first.
Email [email protected] with the steps to reproduce it. We reply within 3 business days, keep you updated until it is fixed and credit you if you wish.
- Test only with accounts and stores you own.
- Never access, change or keep other people's data.
- No denial of service, spam or social engineering.
- Give us reasonable time to fix before going public.
Follow these rules in good faith and we will not take legal action against you.
Contact: mailto:[email protected] Preferred-Languages: en, fr Canonical: https://scaleedges.com/ .well-known/security.txtOpen security.txt
Turn on two-factor and your PIN
in under a minute.
Start for €0/month on a platform built to be checked.
Create your free store