Security at Scrub

You're trusting us with the keys to your online identity. Here's exactly how we protect them.

We never touch your passwords

Scrub only needs your email addresses and usernames to scan. We never ask for, receive, or store passwords for any third-party service, and we never log into your accounts — every check runs against publicly available information.

Encryption everywhere

All traffic is encrypted in transit with TLS.
All stored data is encrypted at rest.

Hardened authentication & payments

Sign-in is handled by Clerk, a dedicated authentication provider, with support for multi-factor authentication.
Payments are processed by Stripe (PCI-DSS Level 1). Your card details never touch our servers.

You stay in control

Every email you add is verified with a one-time code before we scan it.
Domains are verified via DNS records to prove ownership.
You can delete any scan input, or your entire account and all its data, at any time from Settings — deletion is immediate.

Reporting a vulnerability

Found a security issue? We want to know. Email security@usescrub.com and we'll respond as fast as we can. Please don't test against other users' data.

For details on what we collect and why, read our Privacy Policy.