Security overview
This page answers the usual questions of a vendor security review. Each item says whether it is in place today or planned. The sub-processor list names every vendor that processes data for us, and the data processing agreement includes these measures as its Annex 2.
Encryption
Encryption in transit In place
Every address we serve answers only over HTTPS (TLS), with HTTP Strict Transport Security.
Body data encrypted with its own key In place
Stored 3D body data and fit results are encrypted at rest with a dedicated key that is used for nothing else.
Sealed merchant secrets In place
Shop credentials, app tokens and two-factor secrets are sealed in a vault (envelope encryption with per-client keys that can be rotated). Nobody reads them in clear text, staff included.
Encrypted backups In place
Nightly backups are encrypted on our servers before they are copied to a separate EU storage provider.
Access control
Back-office sign-in with two-factor authentication In place
Back-office users sign in with a password and can turn on a one-time code app (TOTP). Each user sees only the shops they were invited to.
Widget isolation
Sandboxed widget frame and Content-Security-Policy In place
The size tool runs in its own sandboxed frame on our domain, with a strict Content-Security-Policy, so the shop page cannot read shopper answers and the frame cannot reach the shop page.
Checked messages between page and frame In place
The shop page and the frame talk only through a checked message channel that accepts known origins and known message shapes.
Operations
Bot filtering In place
Events from bots and data-centre addresses are filtered out, so they neither skew statistics nor fill storage.
EU hosting In place
All service data is hosted in the European Union. The vendors we use are on the public sub-processor list.
Testing
Internal security review In place
The widget, the frame and the API had an internal security review; its findings are tracked to closure.
External penetration test Planned: 2027-Q1
An independent penetration test of the widget, the API and the back office, then once a year.
Reporting a security issue
Write to [email protected]. We answer within two working days and ask you not to share the issue publicly before it is fixed.