Security
Effective 8 September 2026. How the service is built, and what has and has not been independently reviewed.
SelfCheck is operated by Pavlo Kushnirenko, acting as an individual. The operating company is in the course of being incorporated; until it exists, no contract is offered or concluded through this site, and the data controller is a named individual rather than a company.
How uploads are handled
Every uploaded file is treated as hostile. Parsing runs in an isolated container under an unprivileged account, with no access to account data and no ability to reach the database. Raw message content is never written to application logs.
Credentials
Passkeys are the primary credential: unphishable, not reused across sites, and never leaving your device — what we hold is a public key, which grants nobody access if it leaks. Where a passphrase is used instead it is stored only as a salted, heavily iterated hash.
Access tokens for shared records, one-time codes and session identifiers are all stored only as hashes. A person reading our database could see that access was granted and when it was used, and could not use it.
Transport and browser hardening
HTTPS is enforced with HSTS. A restrictive content security policy forbids inline script and any third-party origin. The site is not framable, sends no referrer, and asks not to be indexed.
What has not been done
No independent penetration test or security audit has been carried out. No certification against ISO 27001, SOC 2, Cyber Essentials or any other scheme is held or claimed. This is a pilot, and saying otherwise would be the sort of claim this product exists to discourage.
Reporting a vulnerability
Write to [email protected]. We will acknowledge within five working days. Please give us a reasonable period to fix an issue before publishing it, and please do not access, alter or retain other people's data while testing.
Data controller: Pavlo Kushnirenko, acting as an individual. Correspondence to [email protected]. Governing law: England and Wales.