AN INDEPENDENT, CHECKABLE TRUST RECORD

animatedwebs.com

Know what was checked. Understand what was claimed.

Active with warnings

IssuedOct 31, 2026, 6:33 AM UTC

Last checkedNov 1, 2026, 6:28 AM UTC

ExpiresJan 30, 2027, 6:28 AM UTC

Ownership methoddns txt

Verified by TrustCertia

Passed checks are verified at the displayed time. Presence checks do not establish compliance.

HTTPS reachable

HTTPS returned 200.

View evidence · Nov 1, 2026, 6:28 AM UTC

{
  "url": "https://animatedwebs.com/",
  "statusCode": 200,
  "protocolObserved": "HTTP/1.1",
  "http3Advertised": true,
  "altSvc": "h3=\":443\"; ma=2592000",
  "pwaManifestReferenceFound": true,
  "serviceWorkerReferenceFound": false,
  "note": "Advertisements and asset references are informational only. HTTP/3 negotiation and browser installability were not tested."
}

Passed

Valid TLS certificate

TLS TLSv1.3; 54 days until certificate expiry.

View evidence · Nov 1, 2026, 6:28 AM UTC

{
  "protocol": "TLSv1.3",
  "validTo": "Dec 26 05:30:32 2026 GMT",
  "authorized": true,
  "daysRemaining": 54
}

Passed

HTTP → HTTPS redirect

HTTP redirects to HTTPS.

View evidence · Nov 1, 2026, 6:28 AM UTC

{
  "finalUrl": "https://animatedwebs.com/",
  "statusCode": 200
}

Passed

Strict Transport Security

HSTS protects future connections.

View evidence · Nov 1, 2026, 6:28 AM UTC

{
  "value": "max-age=63072000; includeSubDomains; preload",
  "maxAge": 63072000
}

Passed

Content Security Policy

CSP found; review missing restrictions or unsafe directives.

View evidence · Nov 1, 2026, 6:28 AM UTC

{
  "value": "default-src 'self'; script-src 'self' 'unsafe-inline' https://umami-ntlcnoigz4fduqamwihson2m.regescore.pro https://in.heycatch.ai; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' data: https://fonts.gstatic.com; img-src 'self' data: blob: https:; media-src 'self' blob: https:; connect-src 'self' https://supabasekong-iafs2g10tvuivle53yd8amft.regescore.pro wss://supabasekong-iafs2g10tvuivle53yd8amft.regescore.pro https://umami-ntlcnoigz4fduqamwihson2m.regescore.pro https://in.heycatch.ai; frame-src 'self' https://*.animatedwebs.com; worker-src 'self' blob:; frame-ancestors 'self' https://*.animatedwebs.com; base-uri 'self'; form-action 'self' https://checkout.stripe.com https://billing.stripe.com; object-src 'none'; upgrade-insecure-requests",
  "grade": "needs_review",
  "unsafeDirectives": [
    "script-src 'self' 'unsafe-inline' https://umami-ntlcnoigz4fduqamwihson2m.regescore.pro https://in.heycatch.ai",
    "style-src 'self' 'unsafe-inline' https://fonts.googleapis.com"
  ]
}

Warning

Browser security headers

Checks MIME sniffing, framing protection, and referrer policy.

View evidence · Nov 1, 2026, 6:28 AM UTC

{
  "nosniff": "nosniff",
  "framing": "SAMEORIGIN",
  "referrer": "strict-origin-when-cross-origin"
}

Passed

Privacy policy

A privacy policy page was found (presence only).

View evidence · Nov 1, 2026, 6:28 AM UTC

{
  "url": "https://animatedwebs.com/privacy",
  "statusCode": 200,
  "presenceOnly": true
}

Passed

Terms of service

A terms page was found (presence only).

View evidence · Nov 1, 2026, 6:28 AM UTC

{
  "url": "https://animatedwebs.com/terms",
  "statusCode": 200,
  "presenceOnly": true
}

Passed

Cookie consent signals

No recognized consent banner signals found. Manual review may be needed.

View evidence · Nov 1, 2026, 6:28 AM UTC

{
  "match": null
}

Warning

Security contact file

A readable contact file has valid basic Contact and Expires fields. Listed policies and signatures are not independently verified.

View evidence · Nov 1, 2026, 6:28 AM UTC

{
  "url": "https://animatedwebs.com/.well-known/security.txt",
  "statusCode": 200,
  "valid": true,
  "errors": [],
  "warnings": [],
  "contactCount": 1,
  "expires": "2027-10-15T00:00:00.000Z",
  "policyUrls": [
    "https://animatedwebs.com/ai#security"
  ],
  "signatureVerified": false
}

Passed

AI-readable site guide

A AI-readable guide was found (presence only).

View evidence · Nov 1, 2026, 6:28 AM UTC

{
  "url": "https://animatedwebs.com/llms.txt",
  "statusCode": 200,
  "presenceOnly": true
}

Passed

AI disclosure page

A AI disclosure page was found (presence only).

View evidence · Nov 1, 2026, 6:28 AM UTC

{
  "url": "https://animatedwebs.com/ai-disclosure",
  "statusCode": 200,
  "presenceOnly": true
}

Passed

Self-attested by the site owner

These claims have not been independently verified.

AI usage

OpenAIAnthropicGoogleOtherOpen-source / self-hosted

Not affiliated with or endorsed by the named providers.

Purposes: Customer support, Decision making, Personalization, Content generation, Code generation, Other
Customer data used for training: no
Human review: yes
AI disclosed to users: yes

Data & technology

Data location: Not disclosed
Security contact: Not disclosed
Record enquiries: Contact TrustCertia
AI-assisted development: Yes

Product profile · owner statements

Organization & ownership

What kind of product is this?: MarketplaceOwner-supplied supporting evidence ↗Owner declaration. A public scan cannot establish this control; a dated configuration review or scoped independent report is needed.
Public legal entity or trading name: Like a King Inc.Owner-supplied supporting evidence ↗Compare the legal entity in published terms and privacy notices; registry confirmation requires a separate review.
Business jurisdiction: New York, United StatesOwner-supplied supporting evidence ↗Link a public policy or dated evidence summary. Presence can be observed; the underlying practice requires independent review.
Who is the service intended for?: BusinessesLink a public policy or dated evidence summary. Presence can be observed; the underlying practice requires independent review.
Public support or contact page: https://animatedwebs.com/contactOwner-supplied supporting evidence ↗Link a public policy or dated evidence summary. Presence can be observed; the underlying practice requires independent review.
Age restrictions and child data policy: Not directed to children under 13 and no knowing collection of their data (deleted on request). Users must be at least 16 (or the age of digital consent where they live); buying a plan and joining the Creator or Affiliate programs requires 18+.Owner-supplied supporting evidence ↗Link a public policy or dated evidence summary. Presence can be observed; the underlying practice requires independent review.
Which domains, apps and services does this record cover?: animatedwebs.com and mcp.animatedwebs.com (the Service as defined in the Terms of Use).Owner-supplied supporting evidence ↗Owner declaration. A public scan cannot establish this control; a dated configuration review or scoped independent report is needed.
Public privacy, legal and billing contact channels: Privacy, billing and refunds, security reports and copyright notices all go through the public contact form using the matching topic.Owner-supplied supporting evidence ↗Link a public policy or dated evidence summary. Presence can be observed; the underlying practice requires independent review.

Frameworks & build tools

Frontend frameworks: Next.jsPublic asset fingerprints are hints. A versioned repository or deployment attestation gives stronger evidence.
Backend and runtime: Node.jsOwner declaration. A public scan cannot establish this control; a dated configuration review or scoped independent report is needed.
Runtime and framework versions / maintenance policy: Next.js 16 and React 19 on Node.js 24 (container image). Dependencies are kept current through weekly Dependabot update pull requests.Owner declaration. A public scan cannot establish this control; a dated configuration review or scoped independent report is needed.
Package manager and lockfile policy: npmOwner declaration. A public scan cannot establish this control; a dated configuration review or scoped independent report is needed.
Source and CI providers: GitHubOwner declaration. A public scan cannot establish this control; a dated configuration review or scoped independent report is needed.
What review and automated checks gate a production release?: Pull requests and pushes to main run an automated security baseline workflow: secret scan (Gitleaks) and vulnerability scan (Trivy and npm audit); third-party CI actions are pinned to commit SHAs.Owner declaration. A public scan cannot establish this control; a dated configuration review or scoped independent report is needed.
Dependency patching schedule and vulnerability handling: Dependabot opens weekly npm and GitHub Actions update pull requests (minor and patch updates grouped); the security baseline also runs on a weekly schedule.Owner declaration. A public scan cannot establish this control; a dated configuration review or scoped independent report is needed.
Third-party license and asset rights review: Demo media comes from licensed stock libraries, generators we hold rights to, or partners who gave permission; open-source parts keep their own licences, noted in each template.Owner-supplied supporting evidence ↗Owner declaration. A public scan cannot establish this control; a dated configuration review or scoped independent report is needed.
AI coding tools, low-code builders and generated-code review: Template code, build prompts and sample copy are written with AI coding assistants and language models, then pass an automatic validator and are reviewed and tested before publication.Owner-supplied supporting evidence ↗Owner declaration. A public scan cannot establish this control; a dated configuration review or scoped independent report is needed.

Hosting & deployment

Hosting and deployment services: Coolify / self-hostedDNS, response headers and public assets may indicate a provider. They do not prove account ownership or secure configuration.
Production, backup and log storage regions: Application, database, authentication and analytics are self-hosted on our own servers at Hetzner (Germany/Finland, EU), deployed with Coolify.Owner-supplied supporting evidence ↗A datacenter hint is not a residency guarantee. Review per-service region configuration and processor agreements.

Data & subprocessors

Database and storage services: SupabaseOwner declaration. A public scan cannot establish this control; a dated configuration review or scoped independent report is needed.
What personal, sensitive or customer data is collected?: Account data (email, hashed password or sign-in link data), optional profile data, library and API key metadata, billing status and Stripe customer ID (card data stays at Stripe), Creator/Affiliate program data, contact messages, server logs. No sensitive categories such as health or biometric data.Owner-supplied supporting evidence ↗Link a public policy or dated evidence summary. Presence can be observed; the underlying practice requires independent review.
Purposes and legal bases for personal data processing: Providing the service (contract); running Creator and Affiliate programs (contract); legal duties such as tax reporting (legal obligation); security and fraud prevention (legitimate interests); newsletters only if opted in (consent).Owner-supplied supporting evidence ↗Link a public policy or dated evidence summary. Presence can be observed; the underlying practice requires independent review.
Retention periods, deletion and backup expiry: Account and profile data deleted within 30 days of a deletion request; creator profiles removed from public view within 7 days of leaving; transaction, commission, payout and tax records 7 years; contact messages up to 2 years; server logs up to 30 days.Owner-supplied supporting evidence ↗Link a public policy or dated evidence summary. Presence can be observed; the underlying practice requires independent review.
Data export and account deletion process: Request access, export or deletion through the contact form from your account email; we reply within 30 days (45 where US state law allows) and delete account data within 30 days of a deletion request.Owner-supplied supporting evidence ↗Link a public policy or dated evidence summary. Presence can be observed; the underlying practice requires independent review.
Public subprocessor register and change notices: No separate register. Processors are described in section 5 of the Privacy Policy (Hetzner hosting, HeyCatch analytics, Stripe payments, payout and email providers); material changes are announced by updating that policy.Owner-supplied supporting evidence ↗Link a public policy or dated evidence summary. Presence can be observed; the underlying practice requires independent review.
Analytics, tracking and session replay services: OtherOwner declaration. A public scan cannot establish this control; a dated configuration review or scoped independent report is needed.
Cross-border transfer safeguards and DPA availability: The company is US-based and servers are in the EU; cross-border transfers rely on the EU Standard Contractual Clauses with providers that offer them. No public DPA is published.Owner-supplied supporting evidence ↗Link a public policy or dated evidence summary. Presence can be observed; the underlying practice requires independent review.
Consent controls for nonessential cookies and tracking: Only strictly necessary cookies plus one first-party referral cookie (aw_ref) that asks for consent in the EU/EEA/UK/Switzerland and is not set when Global Privacy Control or Do Not Track is sent. Analytics are cookieless (self-hosted Umami; HeyCatch stores no cookies or identifiers, masks text and excludes private routes), so no consent banner is required for analytics.Owner-supplied supporting evidence ↗A banner can be detected heuristically; actual prior blocking and consent behavior require browser tests.

Identity & security

Authentication services: Supabase AuthOwner-supplied supporting evidence ↗Owner declaration. A public scan cannot establish this control; a dated configuration review or scoped independent report is needed.
Roles, least privilege and tenant isolation: Row-level access controls in the database and restricted admin access.Owner-supplied supporting evidence ↗Owner declaration. A public scan cannot establish this control; a dated configuration review or scoped independent report is needed.
Database authorization / row-level security controls: Row-level security / row-level access controls in the database.Owner-supplied supporting evidence ↗Owner declaration. A public scan cannot establish this control; a dated configuration review or scoped independent report is needed.
Encryption in transit and at rest, including key ownership: Encrypted connections (HTTPS with HSTS preload); passwords are hashed; payment card data is handled only by Stripe.Owner-supplied supporting evidence ↗Owner declaration. A public scan cannot establish this control; a dated configuration review or scoped independent report is needed.
Incident handling and customer notification process: If a breach affects personal information we notify affected people and regulators as the law requires (New York SHIELD Act and similar laws).Owner-supplied supporting evidence ↗Link a public policy or dated evidence summary. Presence can be observed; the underlying practice requires independent review.
Vulnerability disclosure and security.txt URL: security.txt published with a contact and policy link; reports go through the contact form with the topic Security report; coordinated disclosure is requested.Owner-supplied supporting evidence ↗The scanner checks security.txt syntax, contact and expiry. It does not establish response quality.
Audit logging, monitoring and access review process: Server logs (IP address, user agent, timestamps) are kept up to 30 days for security and debugging; AI generations are logged by account ID, tool, model and time.Owner-supplied supporting evidence ↗Owner declaration. A public scan cannot establish this control; a dated configuration review or scoped independent report is needed.

Billing & customer rights

Payment and billing providers: StripeOwner declaration. A public scan cannot establish this control; a dated configuration review or scoped independent report is needed.
Do your systems store or process raw card data?: No — hosted checkoutOwner declaration. A public scan cannot establish this control; a dated configuration review or scoped independent report is needed.
Cancellation, renewal notices and refunds: Pro renews monthly or yearly until cancelled; cancel any time in the dashboard and keep access to the end of the paid period. All sales are final; refunds only for duplicate or erroneous charges, no access within 7 days of report, or where required by law (request within 14 days). Lifetime and Prompt Packs are one-time and not refundable.Owner-supplied supporting evidence ↗Link a public policy or dated evidence summary. Presence can be observed; the underlying practice requires independent review.
Public pricing page: Free $0; Prompt Pack $29 one-time; Pro $19 per month or $149 per year; Lifetime $199 one-time founding price.Owner-supplied supporting evidence ↗Link a public policy or dated evidence summary. Presence can be observed; the underlying practice requires independent review.
Terms, EULA and customer agreement URLs: Terms of Use, Privacy Policy, Refund Policy and Cookie Policy are published at the linked pages: /terms, /privacy, /refunds, /cookies.Owner-supplied supporting evidence ↗Link a public policy or dated evidence summary. Presence can be observed; the underlying practice requires independent review.

AI, agents & integrations

Model families, hosting and inference providers: Third-party hosted model APIs: OpenRouter free models and Groq for free users; OpenAI, Anthropic, Google Gemini, xAI and Hugging Face for paid features. Users may also add their own Anthropic, OpenAI, xAI or OpenRouter key in the Design workspace.Owner-supplied supporting evidence ↗Owner declaration. A public scan cannot establish this control; a dated configuration review or scoped independent report is needed.
Prompt, output and provider retention rules: Generation log keeps account ID, tool, the first 1,200 characters of the prompt, model and time; Design workspace AI requests log only account ID, model and time. Generated output is not kept in the log. Prompts and designs are not used to train AI models; providers process requests under their own policies.Owner-supplied supporting evidence ↗Link a public policy or dated evidence summary. Presence can be observed; the underlying practice requires independent review.
AI feature opt-out and non-AI alternatives: AI tools (UI generator, Design Studio, MCP server) are optional; the template library and prompts can be used without them.Owner-supplied supporting evidence ↗Link a public policy or dated evidence summary. Presence can be observed; the underlying practice requires independent review.
Connected MCP servers and external tools: AnimatedWebs MCP server at https://mcp.animatedwebs.com with OAuth sign-in or aw_ API keys. It receives only the requests a client sends to its tools and gets no access to the user's assistant, editor or files.Owner-supplied supporting evidence ↗Owner declaration. A public scan cannot establish this control; a dated configuration review or scoped independent report is needed.
AI evaluation, monitoring and harmful-output reporting: For AI-generated template media, people pick the shots and reject clips with artefacts, demos are render-checked in a headless browser, and the owner approves each batch before release.Owner-supplied supporting evidence ↗Owner declaration. A public scan cannot establish this control; a dated configuration review or scoped independent report is needed.
Consequential automated decisions and human appeal process: No automated decisions with legal effects.Owner-supplied supporting evidence ↗Link a public policy or dated evidence summary. Presence can be observed; the underlying practice requires independent review.
Sensitive-data redaction before model and tool requests: Users are told not to put passwords, API keys, payment details or other sensitive personal data in prompts.Owner-supplied supporting evidence ↗Owner declaration. A public scan cannot establish this control; a dated configuration review or scoped independent report is needed.

Accessibility & application behavior

Accessibility target and testing methods: Designs respect reduced-motion settings, performance budgets and mobile screens.Owner-supplied supporting evidence ↗A claim requires a scoped accessibility evaluation; a passive HTTP scan cannot certify WCAG conformance.
HTTP/2 and HTTP/3 deployment support: HTTP/3 is advertised on animatedwebs.com (Alt-Svc h3).Alt-Svc is an advertisement, not proof of negotiated HTTP/3. Use a compatible network client for protocol verification.
Public API, OAuth scopes, webhooks and rate limits: Public MCP server (OAuth or aw_ API keys), public Markdown catalog feed and an OpenAPI description of the public feed for AI agents.Owner-supplied supporting evidence ↗Link a public policy or dated evidence summary. Presence can be observed; the underlying practice requires independent review.
Customer portability and service shutdown policy: Personal data export in a portable format on request; sites you build from a template stay yours and can stay online after your plan ends.Owner-supplied supporting evidence ↗Link a public policy or dated evidence summary. Presence can be observed; the underlying practice requires independent review.

Compliance programs · self-attested

SOC 2Aligned

ISO 27001Aligned

Attested: Oct 31, 2026, 6:31 AM UTC. The owner is responsible for maintaining accuracy.

Status history

Public, append-only events from the last 90 days.

scan completed

Scheduled scan completed: 10/12 checks passed.

Nov 1, 2026, 6:28 AM UTC

issued

Public certificate published.

Oct 31, 2026, 6:33 AM UTC

disclosures updated

Owner reconfirmed self-attested disclosures.

Oct 31, 2026, 6:31 AM UTC

scan completed

Manual scan completed: 10/12 checks passed.

Oct 31, 2026, 6:27 AM UTC

ownership verified

Domain ownership verified using dns_txt.

Oct 31, 2026, 6:26 AM UTC

scan completed

Scheduled scan completed: 10/12 checks passed.

Oct 31, 2026, 5:00 AM UTC

scan completed

Scheduled scan completed: 10/12 checks passed.

Oct 30, 2026, 5:00 AM UTC

scan completed

Scheduled scan completed: 10/12 checks passed.

Oct 29, 2026, 5:00 AM UTC

scan completed

Scheduled scan completed: 10/12 checks passed.

Oct 28, 2026, 5:00 AM UTC

scan completed

Scheduled scan completed: 10/12 checks passed.

Oct 27, 2026, 5:00 AM UTC

scan completed

Scheduled scan completed: 10/12 checks passed.

Oct 26, 2026, 4:55 AM UTC

scan completed

Scheduled scan completed: 10/12 checks passed.

Oct 25, 2026, 4:50 AM UTC

scan completed

Scheduled scan completed: 10/12 checks passed.

Oct 24, 2026, 4:45 AM UTC

disclosures updated

Owner reconfirmed self-attested disclosures.

Oct 23, 2026, 4:49 AM UTC

disclosures updated

Owner reconfirmed self-attested disclosures.

Oct 23, 2026, 4:49 AM UTC

disclosures updated

Owner reconfirmed self-attested disclosures.

Oct 23, 2026, 4:49 AM UTC

disclosures updated

Owner reconfirmed self-attested disclosures.

Oct 23, 2026, 4:48 AM UTC

disclosures updated

Owner reconfirmed self-attested disclosures.

Oct 23, 2026, 4:47 AM UTC

disclosures updated

Owner reconfirmed self-attested disclosures.

Oct 23, 2026, 4:47 AM UTC

disclosures updated

Owner reconfirmed self-attested disclosures.

Oct 23, 2026, 4:46 AM UTC

disclosures updated

Owner reconfirmed self-attested disclosures.

Oct 23, 2026, 4:46 AM UTC

disclosures updated

Owner reconfirmed self-attested disclosures.

Oct 23, 2026, 4:45 AM UTC

disclosures updated

Owner reconfirmed self-attested disclosures.

Oct 23, 2026, 4:45 AM UTC

disclosures updated

Owner reconfirmed self-attested disclosures.

Oct 23, 2026, 4:45 AM UTC

ownership verified

Domain ownership verified using dns_txt.

Oct 23, 2026, 4:44 AM UTC

scan completed

Manual scan completed: 10/12 checks passed.

Oct 23, 2026, 4:43 AM UTC

scan completed

Scheduled scan completed: 10/12 checks passed.

Oct 22, 2026, 7:50 PM UTC

scan completed

Scheduled scan completed: 10/12 checks passed.

Oct 21, 2026, 7:45 PM UTC

scan completed

Scheduled scan completed: 10/12 checks passed.

Oct 20, 2026, 7:40 PM UTC

scan completed

Scheduled scan completed: 10/12 checks passed.

Oct 19, 2026, 7:35 PM UTC

scan completed

Scheduled scan completed: 10/12 checks passed.

Oct 18, 2026, 7:35 PM UTC

scan completed

Scheduled scan completed: 10/12 checks passed.

Oct 17, 2026, 7:30 PM UTC

scan completed

Scheduled scan completed: 10/12 checks passed.

Oct 16, 2026, 7:25 PM UTC

scan completed

Manual scan completed: 10/12 checks passed.

Oct 15, 2026, 7:25 PM UTC

scan completed

Manual scan completed: 8/12 checks passed.

Oct 15, 2026, 2:50 PM UTC

ownership verified

Domain ownership verified using dns_txt.

Oct 15, 2026, 2:49 PM UTC

site added

Site added. Waiting for ownership verification.

Oct 15, 2026, 2:47 PM UTC

Community voices

Stars and legitimacy votes are user opinions, separate from automated evidence.

Community signal

Loading community feedback…

What this certificate means

TrustCertia verifies only items marked Verified, at the time shown. It is not an audit and does not certify compliance with any law or standard.

Verified means an automated check passed at the time shown. Self-attested means the owner supplied the claim. A policy or banner being found is a presence check only.

Certificate ID: tc_d1b6880eabcd4c18b6c3f4d4d9284763

Signed JSON Markdown Report a concern