What we check
Every check on a ChecksOut report is listed here, with the exact statement we make when it passes and the evidence we need first. If we can't get the evidence, the report says “Not checked”. We never guess.
Checks marked Required must pass or not apply before an app can show the badge.
Your payment details
Where your card number goes when you pay.
Card details go to the payment provider
Required“Could this app see or keep my card number?”
When it passes, the report says: Card details are typed into the payment provider's own payment form. This app's servers don't receive your full card number.
Evidence we need first
- Card fields load from the payment provider's own web address (a hosted checkout page or an embedded secure field), not from the app.
- No card number, expiry date or security code is sent to the app's own servers during checkout.
- The source code has no fields or database columns for full card numbers.
How we check
Tested from outside · Code read
Doesn't apply when
The app takes no payments.
What it doesn't tell you
This covers how the app handles your card. It doesn't review the payment provider itself or what the developer charges.
Your account and personal data
Whether other people can get at what you store in the app.
Other users can't reach your private data
Required“Could another user see or change my stuff?”
When it passes, the report says: Signed in as two separate test users, neither could read or change the other's private data.
Evidence we need first
- Every data request found in the app was listed, and each was repeated as a second test user, swapping in the first user's record IDs.
- None of those requests returned or changed the other user’s private data.
- Database access rules in the code limit each private record to its owner.
How we check
Tested with two accounts · Code read
Doesn't apply when
The app has no accounts or stores nothing private.
What it doesn't tell you
Covers the features and data types that existed on the review date, tested with two ordinary accounts. It doesn’t cover staff or admin accounts.
The database is locked to outsiders
Required“Could someone skip the app and read the database directly?”
When it passes, the report says: Requests sent straight to the app's database, without signing in, were turned away.
Evidence we need first
- Every table reachable with the public key that ships with the app was tried without signing in.
- Only data meant to be public was returned. Nothing could be written: write attempts that couldn’t change anything were refused, or, where the database accepted the attempt, its access rules allow no rows to be written.
How we check
Tested from outside · Code read
Doesn't apply when
The app's database can't be reached from the browser at all.
What it doesn't tell you
Covers the database as configured on the review date. It doesn't cover backups or the hosting company's own systems.
Your device
Whether the app asks for more access to your computer or phone than it needs.
Nothing to install on your device
“Will this app put software on my computer or phone?”
When it passes, the report says: Signing up and using the app needed no downloads, browser extensions or system permissions.
Evidence we need first
- Sign-up and the main features were used start to finish. When the review can’t sign up itself (because of a bot check, or because the developer made the accounts), the sign-up page was followed as far as it goes without signing up, and the test accounts’ first sign-in stands in for the rest.
- No file download, extension install or system-level prompt was triggered.
How we check
Tested from outside
What it doesn't tell you
Covers sign-up and the main features on the review date. Where a bot check stopped the review, sign-up was followed up to the bot check. A browser’s own update prompts aren’t part of the app.
Camera, microphone and location only when needed
“Is this app watching, listening or tracking where I am?”
When it passes, the report says: The app asks for camera, microphone or location access only when you use a feature that needs it, or not at all.
Evidence we need first
- Every permission request seen during review is listed with the feature that triggered it.
- No permission was requested on page load or for a feature that doesn’t need it.
How we check
Tested from outside · Code read
What it doesn't tell you
Covers what the app asks for. It can’t see what happens after you say yes beyond the review’s tests.
Outside code on the page is listed
“What else runs when I open this app?”
When it passes, the report says: Every outside service that loads code into the app is listed in this report, with what it’s for.
Evidence we need first
- Every script loaded from another web address during review was recorded.
- Each is matched to a known provider and purpose (for example payments, analytics or sign-in).
How we check
Tested from outside
What it doesn't tell you
Lists outside code seen on the review date. Outside services can change their own code later.
Behind the scenes
The basics that protect everyone using the app.
No secret keys left in the open
Required“Could someone find the keys to this app’s systems?”
When it passes, the report says: No private keys or passwords were found in the app's public pages, its code bundle, or its source code history.
Evidence we need first
- The pages and code bundles the app sends to browsers were searched for keys and passwords.
- Common leftover files (like .env or .git folders) were checked on the live site.
- The source code and its full history were searched, including AI coding-tool settings and notes files such as .claude/settings.local.json.
- Passwords written inside commands (like PGPASSWORD=… or sshpass -p …) were searched for, not just well-known key formats.
How we check
Tested from outside · Code read
What it doesn't tell you
Covers what was readable on the review date. It can't tell whether a key leaked somewhere else before.
Your connection is encrypted
Required“Could someone on the same Wi-Fi read what I send?”
When it passes, the report says: Every page is served over an encrypted connection (HTTPS), and browsers are told to always use it.
Evidence we need first
- Plain http:// addresses redirect to https://.
- The site sends a Strict-Transport-Security header.
- No page loads scripts or forms over plain http://.
How we check
Tested from outside
What it doesn't tell you
Covers the app's own web addresses. It doesn't cover other sites the app links to.
Your privacy
Whether the app is upfront about what it collects.
The privacy policy matches what the app collects
“Is this app honest about what it collects about me?”
When it passes, the report says: The app has a privacy policy, and it describes the kinds of personal data we saw the app collect.
Evidence we need first
- Every form field, sign-in option and analytics tool seen during review is listed.
- Each kind of personal data on that list is covered by the privacy policy.
How we check
Tested from outside · Code read
What it doesn't tell you
Compares the policy with what we saw. It isn't legal advice and doesn't check whether the developer follows the policy later.