Most security promises are policies: a document saying what people intend to do. Policies fail quietly, at 2 a.m., when someone is in a hurry. Ours are built into the systems we run, so there is nothing for anyone to remember. This page covers how Pixelworkers handles your credentials, your data and your live systems. For what we collect when you use this site, see the privacy policy.
Your credentials
Your keys never go into any shared file. They live in a separate, locked store, and the record we keep of your account notes only where they are, never what they say. They are read at the moment they are used, and nothing keeps a copy afterwards. If you change a password or rotate a key, the next piece of work uses the new one immediately.
Your keys also never appear in what we produce: not in a report, not in a log, not in a message. That is a rule the system applies to itself.
Your data
Every data connection we hold for you runs through one service that we built and run ourselves. It answers only on the machine it runs on, with no address reachable from outside, and there is only ever one copy of it. When it can’t get an answer from the source, it says so and a person is told; it never fills the gap with a guess.
When you give us access to your analytics for an audit, the access is read-only, on a property you choose, and you can revoke it in your own account at any time.
How changes reach your live site
Nobody here edits your live site directly, not for a typo and not in an emergency. Every change is made in a separate copy, where it can be built and tested without touching anything real.
Before it reaches you, someone who didn’t make the change reviews it: whether it works, and whether every claim in it is true. The reviewer can comment but cannot ship. Shipping happens only when you approve the change, and the approval is recorded in your account’s permanent log, with the date, as part of the work.
Limits and stops
- Spending is kept apart from reading. Anything that spends money or acts in the world runs separately from anything that only reads.
- Limits are set in code. How much, how often and how many at once are fixed in the system, not in the request. A job cannot ask for a higher limit, and a second job that tries to run alongside the first is refused, not queued.
- A gate is a stop. Nothing clicks through a consent screen, a security challenge or a sign-in prompt. Each one halts the work until a person steps in.
- Anything you can’t undo waits for a person. Payments, contracts, pricing, refunds, and anything with legal or financial weight stop and wait for a human decision, every time.
Reporting a security issue
If you believe you’ve found a security problem with this site or with work we’ve delivered, email support@pixelworkers.org with “Security” in the subject line. A person will read it and reply. Please give us a reasonable chance to fix the problem before you share it publicly.
Contact
Pixelworkers, operated by The Commonwealth Creative LLC
support@pixelworkers.org · (804) 424-1348