Trust & security
Payments by Stripe. Data handled properly.
You are handing a tool your card and your brand’s data. This page is what happens to both — every claim on it points at something the product actually does.
- Stripe hosted checkout
- Card numbers never reach us
- Cancel in 2 clicks
What happens the moment
you press Pay
Four steps. Your card number is absent from three of them, and from every server we own.
- 01
We write the order first
Before Stripe is called at all, the order exists on our side with its own reference and the exact amount you agreed to. An order Stripe later answers about is always one we already know — there is no path where a payment arrives for something we cannot identify.
- 02
Stripe takes the card, on Stripe’s page
You are handed to Stripe’s hosted checkout. The card number, expiry and CVC are typed at Stripe, on Stripe’s domain, into a form our code does not render and cannot read. There is nothing on our servers for those digits to leak from, because they never arrive.
- 03
Your bank confirms it is you
Where your bank requires Strong Customer Authentication, Stripe runs the 3-D Secure step with them directly — the same challenge you would get on any properly implemented checkout. We are not in that conversation either.
- 04
Only a signed confirmation activates it
Coming back to a success URL proves nothing, so we do not treat it as proof: the return page asks Stripe what actually happened, and the webhook that credits your account is verified against a secret only Stripe and our server hold. An unsigned request changes nothing.
Stripe
What we store, and what we never see
The third column is the one that matters. “We take security seriously” is worth nothing beside “nothing — it never reaches our servers”.
| Data | Where it lives | What we can see |
|---|---|---|
| Your card number | At Stripe only | Nothing. It is typed on Stripe’s page and never reaches our servers. |
| Card brand, last 4 digits, expiry | Our database | Enough to show you which card is on file and to print an invoice — and nothing that could be charged elsewhere. |
| A card saved for renewals | At Stripe, as a token | A reference that lets us request the next charge you agreed to. Remove the card, or cancel, and no further charge can be made. |
| Your password | Our database, as a scrypt hash | Nothing. A hash cannot be turned back into a password — which is also why we can never email you your old one. |
| The free checker’s visitors | Nowhere | No IP address is stored at all. A one-way fingerprint that changes every day answers “has this visitor checked today?” and nothing else. |
| Your projects, topics and answers | Our database, scoped to your account | Only you. Every page, action and API route re-checks the session against the database before a row is read. |
| Analytics | Nowhere, until you accept cookies | Nothing until you say yes — and a refusal is remembered, not re-asked. |
The free checker keeps no IP address at all. A no-login tool still has to stop one visitor draining the day’s capacity, so it counts a one-way fingerprint derived from the address that is regenerated every day. It answers “has this visitor already checked today?” — the only question the cap asks — and it cannot be reversed into an address or used to link one day’s checks to the next. That was a deliberate choice over the easy column, and the privacy policy says so in the same words.
What is switched on
for every request
Not a policy document — a list of headers, limits and checks that ship on every response this site sends, including this one.
HTTPS everywhere, and enforced
Every response carries HSTS with a one-year lifetime, including subdomains — so after your first visit your browser refuses to talk to us in plain text at all, even if something tries to downgrade the connection.
A closed script allowlist
A Content-Security-Policy ships on every response: a script injected into a page cannot load code from a host we have not allowed, plugins and embeds are off entirely, and an injected form cannot post your input to another origin.
Framing and sniffing shut off
The site cannot be framed by another origin — the modern clickjacking guard plus the legacy header for old browsers — content types are never guessed, referrers are trimmed cross-origin, and camera, microphone and location are denied outright.
Abuse limits on the doors
Sign-in, sign-up and password changes are rate-limited against rapid-fire guessing, sign-ups are capped per address per hour, and the free checker is capped per visitor per day — counted without keeping an address.
Sessions checked against the database
Your session is re-verified on the server on every page, action and route, and your permissions are read from the database each time — never carried on the cookie, where a stale value could outlive a change you made.
Analytics only with consent
Nothing analytics-related loads until you accept it on the cookie banner. Refuse, and no request is made and the refusal is remembered. You can change your mind from the footer on any page.
Leaving is as easy
as arriving
A tool that makes you fight to cancel, export or delete is telling you something. Here all four are buttons in your own dashboard.
Cancel in two clicks
Billing → Payment method → Cancel. No notice period, no fee, no email. Every future charge stops immediately and the period you already paid for still runs out in full.
Take your data with you
Every table on your dashboard exports as CSV or a single spreadsheet, over the same period and model scope you are looking at — no support ticket, no “contact us for an export”.
An invoice for every payment
Each paid order mints a numbered invoice with your own company details on it, listed on your billing page and printable to PDF. Refunds are annotated on the document rather than quietly rewriting it.
Delete the account entirely
You can close your account yourself. It keeps working to the end of the period you paid for — leaving is not a reason to confiscate the days you bought — and then it is erased, not flagged.
The detail behind all of this lives in the privacy policy, the terms and the cancellation & refund policy. Something here not answered? Ask us.
Security questions
Is it safe to pay on Mentionify?
Your card details are never handled by us. Pressing Pay hands you to Stripe’s own hosted checkout page, where the number, expiry and CVC are entered on Stripe’s domain — our code does not render that form and cannot read it. Stripe is certified as a PCI DSS Level 1 service provider, the highest level the card industry defines, and it runs the 3-D Secure check with your bank where Strong Customer Authentication applies.
What card details do you store?
The card brand, the last four digits and the expiry month — the same things printed on a receipt. They exist so you can tell which card is on file and so your invoice is recognisable. The full number is never sent to us, never stored by us, and could not be recovered from what we hold.
How is a saved card for renewals kept?
The card itself stays at Stripe. What we hold is a token that lets us request the specific charge you agreed to — the amount you consented to at checkout, which is also what the renewal is checked against. Cancelling, or removing the card, revokes it; nothing turns it back on except a fresh checkout you complete yourself.
Can someone fake a payment confirmation?
No. We do not act on the browser returning to a success page — the return page asks Stripe what actually happened. The event that credits an account arrives on a webhook that is verified against a signing secret held only by Stripe and our server, and an unsigned or wrongly signed request is rejected before it can change anything.
Do you store my IP address?
Not for the free checker. It needs to stop one visitor draining the day’s free capacity, so it stores a one-way fingerprint derived from the address that changes every day: two checks by the same visitor on the same day collide, which is the entire question the cap asks. It cannot be reversed into an address, and because the date is part of it, checks cannot be linked across days. Like most services we do keep ordinary server logs for debugging and abuse prevention.
Are you SOC 2 or ISO 27001 certified?
No, and we would rather say so than imply otherwise. What we can point at is concrete: card data is out of our hands entirely because it never reaches us, payment confirmations are cryptographically verified, passwords are stored as scrypt hashes, sessions are re-checked against the database on every request, and every response ships HSTS plus a strict Content-Security-Policy. If your procurement process needs specific answers, write to us and we will answer them directly.
What happens to my data if I delete my account?
Your account keeps working until the end of the period you paid for, then it is erased — projects, runs, answers and personal details. Two things survive on purpose: the payment records the law requires us to keep, detached from your identity, and the internal cost skeleton of past AI queries with its content stripped out.
Nothing to trust us with yet.
Run one free check.
One buyer question, asked for real, no account and no card — then decide whether we have earned the next step.