Security and evidence
Security you can verify, evidence you can stand behind
Compliance is only as good as the record behind it. Checkbox keeps a tamper-evident history of what your customers were shown and sent, and is built so that neither a compromised page nor a coding agent can quietly change it.
The evidence vault
Content-addressed and hash-chained
Every screenshot, page, email, consent record and billing setting is stored by its SHA-256 hash and chained to the previous record for the site. Changing or removing anything breaks the chain, and verification shows where.
Signed anchors
Each day, and whenever a certificate or claim needs it, the head of every site’s chain is signed with an Ed25519 key held outside the database. Anchors and certificates can be checked against the published public keys.
Write-once storage
In production the evidence vault uses S3 Object Lock, so stored evidence cannot be overwritten or deleted during its retention period — by anyone, including us.
Independent verification
Evidence exports come with a standalone verifier script that needs only Node.js. Monitoring certificates have a public verification page anyone can open.
The platform
Test and live are separate
Test mode is an isolated sandbox with its own keys and data. Live mode turns on only after you prove control of your domain.
Scoped, role-carrying keys
Secret keys carry a role capped at their creator’s; restricted keys carry per-resource scopes; publishable keys work only for the browser-facing endpoints.
Credentials encrypted at rest
Billing-platform credentials and other secrets are encrypted with AES-256-GCM. Stripe access for lifecycle tests uses test-mode keys only; live keys are refused.
An isolated browser
The browser that visits merchant pages runs in its own service with no database access and no platform secrets, and refuses to start if it can see any. Private and internal addresses are blocked.
Authenticated email
Captured emails are checked for DKIM, SPF, DMARC and ARC. Mail that cannot be authenticated for one of the site’s sending domains is flagged and cannot make a check pass.
Signed webhooks, audited staff access
Webhook deliveries are signed so you can verify they come from Checkbox. Staff actions on customer accounts are recorded in an audit log.
Safe for coding agents
checkbox init never sends your source code or .env values to Checkbox — only file paths, the matching lines of checkout code, your framework and your URLs. Keys are written to a git-ignored env file. A person approves every new connection in the browser, and the account owner is emailed when an agent sets Checkbox up.
Agents get test keys. Live mode needs domain verification, and live keys are issued only when the person approving asks for them.
Questions from your security team?
We are happy to walk through the architecture, data flows and retention. Read the Privacy Policy for what we collect and why.
Talk to usStart in test mode — free
Sign up, get test keys and run your first check in under two minutes. No credit card, no sales call.