Security
Security and data handling
Safeliant sells evidence, so this page is written the way a finding is: statements that can be checked, and an explicit account of what the system does not do. Where a property belongs to a vendor rather than to us, it is attributed to that vendor.
How a scan behaves
What running a check does to a client storefront
The most common security question an agency has is whether pointing this at a client's live store is safe. These are the answers, and each is a property of the scanner as built.
Outside-in only
Safeliant loads public storefront pages in a real browser, the way any visitor would. Nothing is installed on the client site, no code is added to it, and no credentials are required to run a check.
No order is ever placed
The journey walks home, product, add to cart, cart and checkout entry, and stops. No payment details are entered and no order is submitted — the scanner's test suite asserts that payment is never attempted.
No persistent change to the storefront
A run reads pages and adds a product to a cart — the journey cannot be walked without it. It submits no forms, creates no accounts, enters no customer data, and changes no setting, tag, template or catalogue entry. An abandoned cart in a synthetic session is the only trace it leaves.
A blocked check is reported as blocked
A storefront whose bot protection or rate limiter refuses the scanner is recorded as unassessed. It is never reported as healthy and never as broken, and an inconclusive run resolves nothing.
Data handling
What is captured, and where it goes
What evidence contains
Screenshots of storefront pages, request URLs, decoded analytics event payloads, console errors and timing — the observable behaviour of a public page. Findings are produced from that, with the rule id that generated each one.
Whose data it is
Evidence is captured from public storefront pages using a synthetic session Safeliant itself creates. A run does not authenticate as a shopper and does not read any real customer's order, account or personal data.
Evidence is append-only
Findings and their evidence are written per run and kept as the record of what was observed at that moment. Later runs add to the history; they do not rewrite an earlier run's evidence.
Where data is processed
Application hosting, database, payments and transactional email are handled by named subprocessors. Each one, what it is used for and where it operates is listed publicly.
What we do not claim
Certifications we do not hold
Safeliant holds no SOC 2 report, no ISO 27001 certificate and no independent security audit, and does not offer a contractual SLA. Our infrastructure providers hold their own certifications; those are theirs, not ours, and we will not present them as though they were.
If your procurement process requires any of these, tell us what you need and we will tell you honestly whether we can meet it today.
Company and contracts
Who operates Safeliant
Safeliant is a product operated by Lena Corporation, company number (EIK) 206189257, registered at Bulgaria, Sofia, Opylchenska street 117. Security questions go to support@safeliant.com; data-protection questions to privacy@safeliant.com.
See how a finding is produced.
The clearest security answer is the mechanism itself: what was tested, what was observed, and the artefact behind it.