What stays on your WordPress site

Assure is a technical compliance plugin that runs on your WordPress installation. Audit results, evidence, settings, and visitor consent preferences are stored locally. The plugin does not send usage telemetry to ncdLabs.

Where the plugin runs

Information the plugin may store

Depending on how you configure Assure, the plugin may keep:

• Audit runs, control results, findings, and remediation history
• Evidence snapshots and activity log entries
• Consent banner design, categories, and version history
• Enforcement settings for analytics, scripts, and YouTube embeds
• Monitoring schedule and drift detection state
• Public compliance status page settings (when enabled)
• Installed compliance pack metadata and activation state

When using the native consent banner, visitor consent choices are stored in the visitor's browser (localStorage) on your site's origin.

No telemetry by default

The Assure plugin does not send usage statistics, error reports, or analytics to ncdLabs. Discovery and audit scans request your own site's public pages and REST API; those results are not uploaded to ncdLabs.

Optional external connections

Assure contacts external services only in the cases below — and only when you use the related feature.

Pack activation (ncdlabs.com)

When you import a purchased compliance pack, Assure sends your unlock key, framework identifier, and site URL to verify the Stripe purchase and bind the license to one site.

• Endpoint: https://ncdlabs.com/products/assure/api/activate
• When: only when you preview or install an encrypted pack you purchased

Browser verification (optional)

When importing a pack, Assure may call the ncdLabs provisioning API to enable hosted browser verification. If configured, audits and discovery may send scan targets to your browser verification service.

• Provision: https://ncdlabs.com/products/assure/api/browser-verification/provision
• Default service: https://browser-verify.ncdlabs.com
• When: pack import provisioning; during audits when hosted browser verification is enabled

Google Analytics OAuth (optional)

When you connect Google Analytics from Manage → Integrations, Assure may use Google OAuth and the Google Analytics Admin API. If you have not configured your own OAuth client, Assure uses an ncdLabs OAuth proxy.

• Proxy: https://ncdlabs.com/products/assure/api/google/oauth/start and .../exchange
• Google: accounts.google.com, oauth2.googleapis.com, www.googleapis.com, analyticsadmin.googleapis.com, tagmanager.googleapis.com
• When: only when an administrator starts or completes Google Analytics connection
• Google privacy: policies.google.com/privacy

Optional deactivation feedback

When an administrator deactivates the plugin, WordPress may show an optional feedback dialog. You can skip it and deactivate without answering. Closing the dialog cancels deactivation.

If you choose Submit & deactivate, the plugin emails your selected reason and any comments you type to feedback+assure@ncdlabs.com using your site’s normal WordPress mail configuration (wp_mail). Feedback is used only to improve the product.

A separate checkbox (unchecked by default) lets you include diagnostic versions with that email: plugin version, WordPress version, and PHP version. Your site URL and admin email are never included. If you leave the checkbox unchecked, only the reason and comments you entered are sent.

ncdLabs site privacy

Pack purchases, licensing API calls, and optional OAuth proxy traffic are handled under the ncdLabs site privacy policy. Stripe processes payments under Stripe's privacy policy.

Questions

Email privacy questions about Assure or pack licensing.