Skip to main content
UnlistIN
Security & data handling

You're trusting us with the data we remove. Here's how we hold it.

No badge wall, no buzzwords — the actual practices, the actual status of our certifications, and a standing invitation to audit us.

Protecting your data

Encryption, access, and retention

AES-256 encryption at rest
All stored data is encrypted using AES-256-GCM, the same authenticated-encryption standard used by governments and financial institutions worldwide.
TLS 1.3 in transit
All data transmitted between your devices and our servers is protected with TLS 1.3, the latest transport security protocol.
Least-privilege access
Strict role-based access controls ensure only the processes that need your data can touch it. Every access is logged.
Data residency
Your data is stored in data centers operated by SOC 2-certified infrastructure providers. Enterprise customers can specify residency requirements.
Data minimization
We collect only what removals require. Scan data is retained only as long as needed, then securely purged — and you can delete your data anytime.
Audit logging
Every access to sensitive data is logged to a tamper-evident audit trail. Enterprise customers can request access reports for compliance.
Tamper-evident by design

Why our removal proofs can't be quietly edited

Every completed removal is captured as before/after evidence plus a cryptographic record: the artifacts are hashed (SHA-256), the record is signed (Ed25519), and records are chained into a Merkle tree. Change one byte after the fact and verification fails — for us too.

Verify a proof yourself →
Proof anatomy
evidencebefore/after captures
digestSHA-256 of every artifact
signatureEd25519, timestamped
chainMerkle root anchors the history
checkanyone can re-verify, anytime
Compliance, stated honestly

Frameworks we're built to meet — and certifications we won't claim early

GDPR, CCPA, and DPDP are laws, not certificates — no one can be 'GDPR certified', so we say 'designed to meet' and mean it. Audited certifications appear here only when they're real.

GDPR
Designed to meet
Designed to meet the requirements of the EU General Data Protection Regulation, including the right to erasure we exercise on your behalf.
CCPA
Designed to meet
Designed to meet the requirements of the California Consumer Privacy Act, including the deletion and opt-out rights we file for you.
DPDP (India)
Designed to meet
Designed to meet the requirements of India's Digital Personal Data Protection Act — one of the few removal services operating under it.
Why this space looks empty: SOC 2 Type II is in progress and ISO 27001 is being pursued. They'll be published here the day they're certified — not the day marketing wants them.
Operational security

How the platform is run

Resilient infrastructure
Enterprise-grade cloud hosting with multi-region redundancy and automatic failover. Uptime commitments are contractual on Enterprise agreements.
24/7 monitoring
Continuous infrastructure and application monitoring with automated alerting and real-time anomaly response.
Incident response
Documented procedures with defined severity levels and escalation paths. Enterprise customers receive direct notification.
Secure development
Security gates at every stage: design review, code review, automated testing, and dependency scanning before anything deploys.
Penetration testing
Third-party penetration testing is part of our active SOC 2 Type II readiness program, alongside scheduled scans across the full codebase.
Vulnerability management
Automated dependency scanning, static analysis, and continuous vulnerability monitoring across code and infrastructure.
Responsible disclosure

Found a vulnerability? Tell us.

We investigate every legitimate report and work to resolve issues quickly. We ask for reasonable time to fix before public disclosure — and we do not pursue legal action against researchers acting in good faith.

security@unlistin.com

Security teams: come audit us.

We welcome security reviews from enterprise customers — architecture, data handling, and compliance posture, on the table.

Contact the security teamRequest enterprise access