Security and data handling

The website

• Static HTML, CSS and JavaScript served by a CDN. No application server, no database.
• No authentication, no session, no user accounts on this domain.
• No analytics, advertising, tag-manager or session-replay script is loaded. There is no embedded video, chat widget or A/B testing library.
• All pages are the same for every visitor, which is also why the site can be crawled and cached safely.

The free tools

There is no upload endpoint to disable, no object storage bucket and no queue. If a future version adds server-side processing, it will be opt-in and named explicitly on the tool page.

Tracking and cookies

• No cookies are set by this website.
• No analytics or marketing tag is loaded, and no event is sent to a third party. The site has no analytics receiver to configure.
• No fingerprinting: no canvas, font, audio or hardware probing, and no cross-site identifier.
• Declining nothing is required to use a tool: there is no consent gate because there is no optional tracking.

Transport and headers

• HTTPS only, with HSTS enabled by the static host.
• Content-Security-Policy, X-Content-Type-Options, Referrer-Policy, X-Frame-Options, cross-origin policies and a permissions policy are shipped in the site's _headers file and applied by the host.
• The site is served over a CDN with caching; preview builds are excluded from search engines at build time.

The application is separate

This website links to the product application for account features, but the application runs on its own domain with its own authentication, storage and rate limits. The website never handles your credentials. This page describes the website only; it is not a security assessment of the application or of your deployment.

Coordinated disclosure

If you believe you have found a vulnerability in this website or in EmbedHarbor software, email [email protected] with enough detail to reproduce it. Please do not open a public issue first, do not test against other customers' data, and do not run destructive or high-volume tests.

• We will acknowledge the report and tell you what we can commit to on the current team.
• We will keep you informed of the remediation status until the issue is closed.
• There is no paid bounty programme at this stage; we will credit you if you want to be named.
• We will not pursue legal action for good-faith research that respects this policy, applicable law and the limits above.

What this page is not

This page describes the current implementation. It is not a certification, an audit report or a guarantee. We do not claim ISO 27001, SOC 2, GDPR certification or any other third-party attestation. Where a control has not been independently verified, this page says so rather than implying it.