Security & trust

We hold the keys to your sites. Here’s how we keep them safe.

PowerSEC is built for the unglamorous reality of running other people’s WordPress sites: signed actions, scoped keys, encrypted transport, and backups you can actually restore.

Signed, auditable remote actions

Every action PowerSEC sends to a connected site is HMAC-signed with a per-site key. Requests carry a timestamp and a one-time nonce, and are rejected outside a short validity window — so a captured request can’t be replayed. Each action is recorded in the site’s audit log.

Scoped, per-site credentials

Sites authenticate with their own keys, separated by scope: a telemetry key for read/report traffic and a remote key for privileged actions. Compromising one site’s key never grants access to another, and keys can be rotated or revoked from Central.

Secure transport & scoped keys

All traffic between your sites, the dashboard, and Central runs over TLS. Per-site keys are scoped, rotatable, and revocable from Central; billing and third-party integration tokens are encrypted at rest.

Verified, recoverable backups

Backups travel over encrypted (TLS) connections and are kept in secure cloud storage, encrypted at rest by the provider. Each upload is SHA-256-verified and re-checked for integrity in storage — downloaded only through short-lived, signed URLs, never from a public, guessable location.

Least-privilege access

Dashboard access is JWT-based with role separation (owner, team, support, admin). Plan and feature gates are enforced on the server, not just hidden in the UI, so the API is the source of truth for who can do what.

Responsible disclosure

Found a vulnerability? We want to hear about it. Email [email protected] — our vulnerability disclosure policy explains what to send, what is in scope, and how we respond.

How it works

The lifecycle of a signed action.

Every request between a site and Central runs the same gauntlet — sign, verify, authorize, audit — and every new request starts the loop over.

Scoped key

The site holds its own telemetry and remote keys — scoped, rotatable, and revocable from Central.

Sign over TLS

Each request is HMAC-signed over its timestamp, one-time nonce, method, path, and body hash — sent only over TLS.

Verify

Central checks the signature with a constant-time compare, a short timestamp window, and a one-time nonce — so a captured request can’t be replayed.

Authorize

JWT roles (owner, team, support, admin) plus server-side plan and feature gates decide what the caller may do.

Execute & audit

The action runs and is written to the site’s audit log — every privileged change leaves a receipt.

Recover

Integrity-verified backups are pulled only through short-lived, signed URLs — never a public, guessable location.

Site ↔ Central traffic is HMAC-signed; dashboard ↔ Central traffic is JWT-authenticated — both authorized server-side, where the API is the source of truth.

Where your data lives

PowerSEC Central — the dashboard, the API and its database — runs on dedicated servers in the United States, with TLS everywhere: connections between your sites and Central are required to be encrypted (HTTPS). We store the minimum we need to monitor and protect your fleet — security findings, backup metadata, and the settings you configure.

  • Web traffic to powersec.io passes through Cloudflare.
  • Email is delivered by Amazon Web Services (SES).
  • Payments are handled by Stripe; card data never reaches our servers.
  • AI features use Google’s Gemini API, and Google sign-in is optional.
  • Cloud backups are held by our managed cloud storage provider in a United States region, encrypted at rest by the provider, checked with SHA-256 after every upload, and downloaded only through short-lived signed URLs. On paid plans you can also keep a copy in your own S3-compatible storage, in addition to the managed copy.

The full list of providers, including the backup storage provider, is available on request at [email protected].

We do not sell your data. See our Privacy Policy and Terms for how data is handled, retained, and deleted.

What AI Advisory sends

AI Advisory gives a second opinion on files the scanner has already flagged. It runs automatically only after an administrator of the site opts in on that site, and only on eligible protection plans. For each flagged file it sends Google’s Gemini API the file path, the scanner rules that matched with a risk score, and a sampled excerpt of at most 16,000 characters with secrets redacted. A short file can fit within that limit in full.

It never sends whole sites, databases, or files that can hold credentials (wp-config.php, .env, key files). Its verdict is advisory only: it never changes scan results or your security score.

Report a security issue

Responsible disclosure is welcome. Read our vulnerability disclosure policy for what to send, what is in scope, and how we respond, or email [email protected].

[email protected]
Hacked? Talk to us