Tradify · Domain Security

Tradify Domain Security

Domain security

Domain security posture for Tradify, probed live across 4 host(s) and 1 registrable domain(s). 4 host(s) serve HTTPS; 3 advertise HSTS. Email/DNS controls: DNSSEC absent, SPF present, DMARC present (p=none).

Job ManagementTradesField ServiceSchedulingQuotingInvoicingTimesheetsContractorsSoftware-as-a-Service

Transport & Host Security

www.tradifyhq.com
HTTPS: yes · HSTS: yes · cert expires: Sep 12 01:02:51 2026 GMT
tradifyhq.com
HTTPS: yes · HSTS: no
api.tradifyhq.com
HTTPS: yes · HSTS: yes · cert expires: Sep 7 22:39:52 2026 GMT
help.tradifyhq.com
HTTPS: yes · HSTS: yes

Domain (DNS/Email) Security

tradifyhq.com
DNSSEC: no · SPF: yes · DMARC: yes (p=none) · CAA: none

Source

Domain Security

Raw ↑ 
generated: '2026-07-12'
method: probed
source: live DNS/TLS/HTTP probes of Tradify hosts (apis.yml + known app backend)
hosts:
- host: www.tradifyhq.com
  https: true
  tls_issuer: Google Trust Services (WE1)
  cert_expires: Sep 12 01:02:51 2026 GMT
  hsts: true
  hsts_max_age: 31536000
  hsts_include_subdomains: true
  hsts_preload: true
  notes: Marketing site served via HubSpot CMS behind Cloudflare.
- host: tradifyhq.com
  https: true
  redirect: https://www.tradifyhq.com/
  server: Microsoft-IIS/10.0
  hsts: null
  notes: Apex 301-redirects to www; ASP.NET / IIS front responds before redirect.
- host: api.tradifyhq.com
  https: true
  tls_issuer: GoDaddy Secure Certificate Authority - G2
  cert_expires: Sep  7 22:39:52 2026 GMT
  hsts: true
  hsts_max_age: 31536000
  csp: "default-src 'none'; script-src 'self'; connect-src 'self'; img-src 'self'; style-src 'self'; base-uri 'self'; form-action 'self'"
  x_content_type_options: nosniff
  notes: >-
    Live application backend (HTTP 200, empty body at root). Undocumented and
    session-authenticated - used by Tradify's own web/mobile apps, NOT a public
    API. Locked-down CSP (default-src 'none'). TLS cert issuer differs from the
    marketing site, confirming a separate origin.
- host: help.tradifyhq.com
  https: true
  server: cloudflare
  hsts: true
  hsts_max_age: 259200
  notes: Zendesk-hosted help centre.
domains:
- domain: tradifyhq.com
  dnssec: false
  nameservers:
  - hayes.ns.cloudflare.com
  - imani.ns.cloudflare.com
  caa: []
  spf: true
  spf_record: "v=spf1 include:_spf.google.com include:sendgrid.net include:2929749.spf10.hubspotemail.net include:spf.mandrillapp.com include:mail.zendesk.com -all"
  dmarc: true
  dmarc_policy: none
  dmarc_record: "v=DMARC1; p=none; rua=mailto:dmarc@tradifyhq.com; ruf=mailto:dmarc@tradifyhq.com;"
observations:
- All probed public hosts serve HTTPS with HSTS enabled.
- No CAA records are published on tradifyhq.com (multiple CAs observed across hosts - Google Trust Services and GoDaddy).
- DMARC is published but policy is p=none (monitor only), so spoofed mail is not actively rejected/quarantined.
- SPF ends in -all (hard fail) and enumerates Google, SendGrid, HubSpot, Mandrill, and Zendesk as authorized senders.
- No public API host or developer surface was found to probe; api.tradifyhq.com is the app backend and is undocumented.
maintainers:
- FN: Kin Lane
  email: kin@apievangelist.com

Work with this as data

Every security artifact here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for security posture

4 MCP tools reach this
  • find_securityBrowse and filter every security artifact in the catalog.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools

Call it yourself

curl for this page
This security artifact 
curl "https://apis.io/api/v1/security/tradify-domain-security"
All security posture 
curl "https://apis.io/api/v1/security?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no email required.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.