Your privacy.
Our responsibility.

takedowns operates inside a hardened Node.js deployment environment. We enforce strict Content Security Policies (CSP) via Helmet headers, restricting script execution origins, base-uri paths, and prohibiting inline script handlers to mitigate cross-site scripting (XSS) risks.

All network channels route exclusively over TLS 1.3 encryption, ensuring confidentiality and protection against packet-level eavesdropping.

We apply layered request-validation controls on every state-modifying operation to verify browser origin and prevent cross-organization exposure. All database entries are isolated in per-tenant partitions, and direct object references are never exposed through public endpoints.

Perceptual matching is performed in isolated processing pipelines. Raw uploads are minimized and used only for hashing, review, or temporary evidence retention when a case needs proof.

Evidence logs are chronologically structured. When operators verify exposing links, the platform exports a self-contained record of the target page context, response metadata, and available media references into an evidence bundle.

These bundles are stored in isolated directories outside the public web root, protected from indexing, and checksummed to maintain a defensible chain of custody for legal holds.

User credentials are protected with strong adaptive password hashing, salted per account. Session tokens are short-lived, rotated continuously, and bound to secure browser cookies to prevent client-side interception.

Multi-factor authentication is available for every account, ensuring protection even if a primary password is compromised.

All subscriptions, plan changes, and transactions are processed directly via secure Stripe APIs. takedowns servers never store, process, or see raw credit card values, utilizing Stripe's client-side inputs and webhook checks to manage billing states.

We enforce strict Role-Based Access Control (RBAC). General advocates access only assigned survivor case directories. Organization managers manage billing details, and superadmins execute security settings and key rotations. Every configuration adjustment is recorded in system logs.

takedowns is an automated workflow, evidence collection, and compliance notification platform. We are not a law enforcement organization, database index, private investigator service, or legal counsel.

We provide structured technical tools to speed up takedown notices and maintain proof logs. We believe in transparency, publishing data-minimization policies, and running regular server-level safety scans.

Found a security issue? Email security@vesamuni.com with steps to reproduce. A person reads that mailbox, usually the same day. Our machine-readable policy is published at /.well-known/security.txt (RFC 9116).

Please test only with accounts you own, never touch another user's case data, and never fetch or keep any media you come across — that is the whole point of this site. There is no paid bounty programme yet; we credit reporters who want it.