Skip to main content
LaunchGateAUDIT TODAY. LAUNCH TOMORROW.
Run a free launch check

Trust Center

How we handle your code, data and permission.

An audit means letting someone look underneath your app. This page sets out what we ask for, what we never want, how long we keep anything, and where our checks stop.

Chain of custody

Your code, from permission to deletion

Every audit follows the same path. Permission comes first. Deleting our copies comes last.

  1. Before anything

    Written permission

    You confirm in writing that you own the app, or are authorised by its owner, and what we may test. No testing happens until the form is signed.

  2. Access

    Read-only, with test accounts

    Read-only access to the code is enough. A staging or test copy with test accounts is the place we prefer to test. Never send real passwords or customer data.

  3. Testing

    On a safe copy

    We review the code and run attack tests on a safe copy or test environment, never against your live users.

  4. Delivery

    Your report

    We keep your code and your report confidential. The report is yours.

  5. After delivery

    Copies deleted

    We delete our copies of your code and data within 30 days of delivering the report.

Testing authorization

Nothing is tested without written permission

Testing an app you don't own, or haven't been authorised to test, isn't something we do.

Before any testing, we send you a short written permission form. Signing it confirms that you own the app or are authorised by the owner, and sets out what we may test. We test only what the form lists.

Attack tests run on a safe copy or test environment. They never run against your live users.

Please send

  • The signed permission form
  • Read-only access to the code
  • A staging or test copy, ideally with test accounts

Never send

  • Real passwords
  • Customer data

Responsible disclosure

Found a security issue on our side?

Tell us privately first, so we can fix it before anyone else finds it.

What helps us

  • The page or address where the issue is
  • The steps to reproduce it
  • What you saw: the request and response, or a screenshot
  • How to reach you with follow-up questions

What we ask of you

  • Don't access, change or delete data that isn't yours
  • Don't run tests that could slow or take down the site
  • Give us a chance to fix the issue before you share it publicly

This website

What launchgatehq.com does in your browser

No cookies, no trackers and no third-party scripts, plus the test record that shows it.

  • No cookies, first-party or third-party.
  • No analytics, ad pixels or session recording.
  • No third-party scripts, fonts, images or embeds. Every file comes from launchgatehq.com, and the site's build refuses to publish a page that loads one from anywhere else.
  • Browser storage only after you act. Choosing a colour theme or ticking a checklist item saves that choice in your own browser. The cookie notice lists every key.
  • Request forms send nothing to us. They open your own email app with the request filled in, and nothing leaves until you press send.
Pre-consent network test Pass
PageThird-party requestsCookiesStored keysConsole errors
/0NoneNoneNone
/sample-audit-report.html0NoneNoneNone

Last run on 25 October 2026 against the previous version of the site, in a fresh browser profile with no stored consent and no interaction. The same check confirmed these response headers:

  • Strict Content Security Policy
  • HTTPS + HSTS
  • nosniff
  • Framing blocked
  • Referrer-Policy
  • Permissions-Policy

Limitations

Where our checks stop

We say what we tested and what we found. We don't promise more than that.

  • LaunchGate identifies issues based on the checks performed. A report covers the code, settings and date it names, not every possible problem.
  • LaunchGate is not a law firm and does not provide legal advice. Some findings need an attorney or another specialist, and the report says which.
  • We don't issue certifications or attestations (PCI DSS or SOC 2, for example). An audit is not a full manual penetration test by a licensed security firm unless one is arranged.
  • The Free Launch Check is a preliminary public-surface review and is not equivalent to a full audit.
  • We never call an app “secure” or “compliant”. Where a control passes, we write: “No technical evidence of noncompliance detected for the controls tested.”

Read the methodology

About

Who runs LaunchGate

LaunchGate is a pre-launch audit service from VendStop LLC, founded by Lamar Brown. We check websites and apps for security, privacy, legal-readiness and reliability issues before launch, for founders, teams and agencies.

Lamar writes for Launch Intelligence, our blog. To reach us, email hello@launchgatehq.com.

Documents

Policies and references