The free scan reads the public configuration of the domain you submit — the same certificate, headers and DNS records any browser can see. Results are shown to you in your browser. The scanned domain and path (without any query string) appear in operational server logs used only to run and protect the service. Scan results are never published and never sold.
Only scan domains you own or have permission to test — the scan form asks you to confirm that.
Ordering stores your name, email, company (optional), notes (optional) and the domain to assess, so the assessment can be run and delivered. Order records are kept for about 13 months (for delivery follow-up and bookkeeping) and are then automatically deleted.
Payment is handled entirely by Stripe. Your card details go to Stripe and never touch HeaderScope's servers.
Assessment reports are stored in a private, non-public storage bucket. Access is only via signed links that expire after 7 days. Report files are automatically deleted after 12 months. Reports are delivered to you by the consultant personally, from his own mailbox.
Want your order record or report deleted sooner? Message the consultant on LinkedIn and it will be removed.