Uxify runs real user monitoring, UX analytics and AI agents on our customers' websites, so most of the data we handle belongs to their visitors. This page names who is accountable for security at Uxify, how to reach them, and where our security commitments are written down.
Security leadership
Security at Uxify is led by Ivailo Hristov, Chief Technology Officer. He is accountable for the security of the Uxify platform, our infrastructure and the scripts that run on customer sites, and he leads our response to security incidents.
| Security lead | Ivailo Hristov, Chief Technology Officer |
| Security contact | security@uxify.com |
| Data protection contact | legal@uxify.com |
| Legal entity | UXIFY OOD, UIC 204909232 (Bulgaria) |
Report a vulnerability
If you believe you have found a security vulnerability in Uxify, email security@uxify.com. Please include:
- The affected product or component, for example app.uxify.com, the Uxify tracking snippet, the browser extension or the MCP server
- Steps to reproduce, and a proof of concept if you have one
- The impact you think it has
We will acknowledge your report within three business days, keep you updated while we investigate, and tell you when it is fixed. We do not currently run a paid bug bounty programme.
Testing guidelines
- Test only against accounts and data you own.
- Do not access, change or delete other customers' data. If you reach any, stop and tell us.
- No denial-of-service, spam, social engineering or physical attacks.
- Give us reasonable time to fix an issue before you disclose it publicly.
We will not take legal action against anyone who reports a vulnerability in good faith and follows these guidelines.
How we protect customer data
- Data is encrypted in transit with TLS 1.2 or higher, and at rest with AES-256 or an equivalent standard.
- Production systems require multi-factor authentication and role-based, least-privilege access, and access is logged.
- Qualified third parties run vulnerability scans and penetration tests at least once a year.
- We keep a documented incident response plan, and we notify customers of a breach affecting their personal data within 48 hours.
- Our cloud infrastructure providers hold SOC 2 Type II and ISO 27001 certifications for their data centres.
The full list of technical and organisational measures is in Annex II of our Data Processing Agreement.
Service status
Live availability and incident history are published at status.uxify.com.
Machine-readable contact
Our security contact is also published in /.well-known/security.txt, following RFC 9116.