Domain investors and brokers search names they have not bought yet. A leaked search list can tell a competitor what you are about to bid on. That is why privacy of searches is the first thing we design for, and everything below follows from it.
Signing up and signing in
Email code verification
When you create an account, you enter an email address and a password, then a 6 digit code we send to that address. The account is not active until the code is confirmed. This proves that the address belongs to you and stops accounts being opened in someone else's name. Codes expire after a short time and can be used once.
Hashed passwords
Passwords are stored with a one-way, salted hashing algorithm designed for passwords. We cannot read your password and no one on our side can tell you what it is. If you forget it, you reset it through a link sent to your email address.
Sessions
After you sign in, your browser holds a session cookie that is marked secure and HTTP only, so scripts on a page cannot read it. Sessions end when you sign out or after a period without activity. Every form and action carries a security token that protects against forged requests from other sites. Repeated failed sign-in attempts are slowed down to make password guessing impractical.
API keys
The REST API is part of the Broker plan. Keys are created in the panel by a workspace member with the right role. A key is shown in full once, at the moment it is created. After that we keep only a hash of it, the same way we keep passwords, so a key cannot be read back from our database, by us or by anyone who might reach it.
You can see when each key was created and last used, and you can revoke a key at any time. A revoked key stops working on the next call. Keys belong to the workspace, and calls count towards the workspace's monthly limit of 5,000. Keys should never be placed in public code or in a browser application. The rules are on the API page.
Payments
Subscriptions are paid by card through a certified payment processor. You enter card details on the processor's own payment page. Card numbers never pass through or rest on our servers, so a breach of our systems could not expose them. We keep only what we need for billing: the plan, the status, invoices and the last four digits and expiry month of the card.
Every card payment requires 3D Secure, meaning your bank can ask you to confirm the payment in its app or by code. This protects you if your card details are stolen, because a payment cannot go through without your confirmation.
Encryption in transit
Every page, form and API call is served only over HTTPS with current TLS settings. Plain HTTP requests are redirected to HTTPS. This protects your password, your searches and your API key from being read or changed on the network between you and us, including on public Wi-Fi.
Workspace isolation
Every search, saved report, bulk list, portfolio and API key belongs to one workspace. Each request is checked on the server against the workspace of the signed-in user or the API key. A member of one workspace cannot open, list or export the data of another, even by changing an address in the browser. Result pages for searches are marked noindex and are not linked from public pages.
Seat roles on the Broker plan
The Broker plan includes 5 seats in a shared workspace. The workspace owner invites members and gives each a role. An administrator role manages the workspace, billing, API keys and branding, while other members run searches and build reports. When someone leaves your team, removing them from the workspace ends their access at once.
Audit log of exports
On the Broker plan, every export (PDF report, CSV of comps, portfolio CSV and white label report) is written to an audit log with the member, the time and what was exported. Workspace owners can review it in the panel. This answers the question brokers get from their own clients: who took this report out of the system and when.
Private searches
The names you search are private to your workspace. They are never published on the site, never shown to other users, never sold and never used to buy, register or bid on names. For searches without an account, we count the one search per day with a hash of the IP address, not the address itself. More detail is in the privacy policy.
Data we do not hold
The sales data behind each estimate comes from public reports, with the venue and a link to the source for every sale, as described in the methodology. It contains domain names, prices, dates and venues, not the names of buyers or sellers. We do not hold card numbers. We do not run advertising pixels or tracking cookies, as explained on the cookie policy page.
What we do not claim
We prefer to be exact about this. SoldComparables does not hold SOC 2, ISO 27001 or any other security certification, and we do not claim compliance with any certification scheme. We do not offer single sign-on. We do not publish penetration test reports. What we describe on this page are the measures in place, not an audited attestation.
The payment processor we use is certified to the card industry's data security standard for handling card data. That certification covers the processor, not SoldComparables, which is exactly why card data stays with the processor.
How SoldComparables does it at a glance
| Area | Measure |
|---|---|
| Signup | Email and password, confirmed with a 6 digit code |
| Passwords | Salted one-way hash, never readable |
| Sessions | Secure, HTTP only cookie, request forgery tokens, throttled sign-in |
| API keys | Shown once, stored as a hash, revocable at any time |
| Payments | Certified payment processor, 3D Secure, no card data on our servers |
| Network | HTTPS only, current TLS |
| Data separation | Every record tied to one workspace, checked on every request |
| Teams | Seat roles on Broker, instant removal |
| Exports | Audit log on Broker |
| Searches | Private to the workspace, never published or used to buy names |
Reporting a security issue
If you find a vulnerability or think your account has been accessed by someone else, write to [email protected] with a description and the steps to reproduce it. Please do not access data that is not yours, do not run tests that degrade the service and give us reasonable time to fix the issue before sharing it. We reply to every report and tell you when the issue is fixed.
If you think one of your API keys has leaked, revoke it in the panel first, then write to us.
To see these measures in use, run a search with the domain appraisal tool or compare plans on pricing.