Security and data practices

Updated 12 October 2026

This page describes what we do to protect this site and the information you send us. We hold no security certifications and claim none.

This website

• The pages on this site run small scripts of our own for data tables, maps, search pickers and accessibility helpers. They load one third-party script for site analytics. It runs without cookies and sets no analytics cookies. There are no advertising trackers. Some visits are recorded as anonymous session replays; anything typed into a form is masked. The privacy page describes this in full.
• The customer app at app.heimdallresearch.com is a separate site with its own sign-in. The privacy page covers it, and the next section describes how it is protected.
• It is served only over an encrypted connection, and browsers are instructed to refuse an unencrypted one.
• A strict content policy tells your browser to reject any script, frame, or outside resource other than the site's own files and the analytics service named above.
• Forms post to our own domain. Nothing you type passes through a third-party form service.

Customer app and API

• Connections to the app and the API are encrypted, and browsers are told to use encrypted connections only.
• API keys are stored as keyed hashes with a short public prefix. The secret is shown once and cannot be read back.
• Replacing or revoking a key asks for a second code, sent by email or taken from an authenticator if you turned one on. Creating a key asks for one too, except for the first key made at sign-up and, if you have no authenticator, a key made within 10 minutes of signing in with an emailed code. Authenticator recovery codes are stored hashed.
• We email the account when a key is created or revoked. The email names the key prefix and never the secret.
• Requests are limited per key and per organization: 60 requests a minute, a burst of 20 in 5 seconds, and 1,000 a day on a free key. Repeated sign-in code requests are limited per visitor address and per email address.
• The session cookie is HTTP only. A session ends after 24 hours without use and after 30 days at most.
• Error reports and server logs are scrubbed of keys, tokens, sign-in codes, cookies and email addresses. Our own server logs leave out query strings, headers and visitor addresses.
• Password reset links and the sign-up link in our emails keep their value after the # sign, so it stays out of server logs.
• Signed download links for files last 15 minutes.
• The owner of an account can delete it. The organization's data is purged 90 days after the request, as described on the privacy page.
• Not done: a sign-in session record, with its IP address and browser type, is not deleted when the session ends. It stays until the account is purged.
• Not done: usage records are not cleaned up on their own. They are kept until the account is purged.

The rules for using the API and the data are in the Data Use Policy.

Information you send us

• Inquiries and form submissions are used to answer you, and to manage a working relationship if one follows.
• Access is limited to the people who need it for the work.
• We do not sell personal information and do not use it for third-party advertising.

Please do not send confidential, classified, export-controlled, or otherwise sensitive project information through the contact forms. If an exchange needs protection, say so first and we will set up an appropriate arrangement before you send anything.

Client data and engagements

• How client data is handled, stored, retained, and deleted is set in the written agreement for that engagement, not by this page.
• Where an engagement calls for deployment inside an environment you control, that is scoped and agreed in writing.
• We do not hold a facility clearance, a government certification, or an approved cloud authorization. If a requirement depends on one, tell us early and we will say whether we can meet it.

What we will not claim

No system is completely secure. We maintain reasonable administrative, technical, and organizational safeguards suited to the work.

Reporting a problem

If you believe you have found a security issue with this site, or with anything we publish, write to security@heimdallresearch.com. Tell us what you found and how to reproduce it. We will confirm that we received it. Please give us a reasonable chance to fix it before publishing details, and do not test a problem on other people's accounts. The same contact is in our security.txt file.