Security

What we never ask for

Never your API keys, passwords, signing secrets or logins. If someone using our name asks for them, it is not us.

What our scan sends

A few light requests to the address you give us. They use the user agent TillpingProbe/1.0. They include a request with no signature and a request with a fake signature. We never send real payment events, real card data or real customer data. Our requests come from cloud servers whose IP addresses can change, so we cannot give you a fixed list to allow.

How we protect other people

• We refuse private, internal and local addresses, including tricks such as odd number formats or DNS names that point inside a network.
• We check the address again after every redirect.
• We cap the size of what we read, the time we wait and the number of requests.
• We rate limit scans per visitor and per day.
• Weekly monitoring only runs on domains you verified.

How we protect your data

• All traffic uses HTTPS.
• Data lives in Supabase with row-level security turned on for every table.
• We keep secrets in server settings, not in code, and we never show them in pages.
• We store IP addresses only as salted hashes.
• We do not store card numbers.

What we cannot promise

Tillping is a small, new service built and run by one small team. We have not had an outside security audit. We do our best and fix problems fast.

Report a problem

Email support@tillping.online with "Security" in the subject. We will reply and fix real issues.