Security

How documents are isolated, what we store and for how long, and how to report a vulnerability.

Last updated 31 August 2026

Reporting a vulnerability

Email [email protected] with enough detail to reproduce. We acknowledge within two business days and aim to resolve or mitigate within thirty.

We will not pursue legal action against researchers who act in good faith: no accessing other people's data beyond what is needed to demonstrate the issue, no degrading the service for others, and no public disclosure until a fix is out. There is no paid bounty programme today; credit is given where wanted.

How rendering is isolated

Each document renders in a fresh browser context — separate cookies, storage and cache — so one customer's content cannot observe another's.

URL rendering refuses private, loopback, link-local, reserved and cloud-metadata address ranges, and the check runs on every navigation, not just the URL you submit, which is what stops redirect-based server-side request forgery. Non-HTTP schemes such as file:// are refused outright. The reasoning is written up in URL-to-PDF and SSRF.

Render hosts hold no credentials of ours and reach only the public internet.

Data handling

HTML you send is processed in memory to produce the document and is not written to disk or retained.

Generated documents are stored only when you ask (store, response: json, jobs and batches). They live seven days, then are deleted permanently by an automated job.

Document links are signed with HMAC and expire. Identifiers are random, not sequential, so nobody can enumerate other accounts' files.

API keys are stored as SHA-256 hashes. We cannot read them, and neither can anyone who obtains a copy of the database.

Request metadata — time, size, duration, status — is kept for 90 days for support and abuse prevention.

Infrastructure

TLS on every connection, HSTS enabled. Traffic passes through Cloudflare; origin servers are in Europe.

Payments are handled entirely by Stripe — card details never reach our servers.

Database backups run daily, are kept for fourteen days, mirrored to a second host, and restore is tested rather than assumed.

The administrative interface is restricted by IP address and is not reachable from the public internet.

What we do not claim

No SOC 2 or ISO 27001 certification today. If your procurement requires one, say so before buying — we would rather lose the sale than imply an audit that does not exist.

No formal SLA on the free plan. Paid plans get best-effort priority and the measured uptime published on the status page.