Do you have SOC 2 or ISO 27001 certification?

Not today, and we will not imply otherwise. What we can show you is how the system is actually built: per-workspace scoping enforced on every request, credentials stored only as hashes, audience-scoped service tokens, and a published methodology. If a certification is a procurement requirement, tell us and we will be straight about the timeline.

Does MentionBeat need access to my website or CMS?

No. Measurement reads the public web the way an answer engine does, so a first run needs only a domain — no tag, no script, no DNS record. A CMS connection is optional and only exists to save you a copy-paste when you publish.

How do I report a vulnerability?

Email hello@mentionbeat.com with enough detail to reproduce it. We will acknowledge within two business days, keep you updated while we fix it, and credit you if you want the credit.

Security — how MentionBeat protects your workspace

Last updated 29 July 2026.

Access to your workspace

Every API request resolves to one workspace, and data access is scoped to it on the query, not filtered afterwards. A token for one workspace cannot read another's runs.
Passwords are stored only as PBKDF2-SHA256 hashes with a per-user salt. We cannot read your password, and neither can anyone who reaches the database.
API keys are stored as hashes too, shown once at creation, and revocable by you at any time.
Session and service tokens are audience-scoped: a token minted for one service is rejected by the others, so a leaked token has the smallest possible blast radius.
Single sign-on is self-serve OIDC — your issuer, your client ID, your domain allowlist, configured in workspace settings without a sales conversation.

What our servers do on the internet

The product fetches other people's pages, which is exactly the capability an attacker would like to borrow. Every outbound fetch — the free checker, the crawler check, the site audit — goes through a guard that resolves the target first and refuses private, loopback and link-local addresses, redirects included. Public tools are rate-limited per IP with a daily ceiling, and the free tools run under a dedicated tenant so anonymous checks never land in a customer's history.

Data at rest and in transit

All traffic is served over TLS.
Databases and backups are encrypted at rest by our hosting provider; every backup is verified before it is kept — its size is checked against a floor and its archive is parsed to confirm it actually contains table data, so a failed dump fails the job instead of quietly uploading an empty file behind a green tick.
Card details never touch our servers — checkout runs directly with Stripe.
Free-tool results expire; raw page-view rows are deleted after 90 days. See the privacy policy for the full retention table.

What we do not claim

We are not certified against SOC 2 or ISO 27001 today, and we would rather say so plainly than imply a badge we do not have. If a certification is a procurement requirement for you, tell us and you will get a straight answer about the timeline instead of a maybe.

Reporting a vulnerability

Email hello@mentionbeat.com with enough detail to reproduce the issue. We acknowledge within two business days, keep you posted while we fix it, and will not threaten anyone who reports something in good faith.