Security and data handling

What happens to the pages and files you send, how rendering is isolated, and which addresses are refused.

What we keep#

Rendered files are streamed back in the response and not stored, unless you ask for response_type: "url". Those files are deleted after 24 hours.
Cached results are kept only when you send cache: true, for cache_ttl seconds (at most 7 days).
API keys are stored only as SHA-256 hashes. We can't read your key, which is why a lost key is replaced, not recovered.
Usage counts are kept per key and day for your dashboard and billing.

The privacy policy has the full details.

How rendering is isolated#

Every request gets a fresh, private browser context: no cookies, storage or cache are shared between requests or customers.
Each render has a hard time limit. A browser that doesn't close in time is shut down and replaced.
Browser processes are restarted regularly.

Addresses that are refused#

To protect our network and yours, the renderer only reaches public internet addresses:

localhost, private ranges (10.x, 172.16–31.x, 192.168.x), link-local and cloud metadata addresses (169.254.x), and their IPv6 equivalents are refused, including disguised forms.
Non-HTTP schemes such as file:// are refused.
Every request the page makes, including redirects, iframes and scripts, goes through the same check, and DNS is resolved by our filter so a hostname can't switch to a private address mid-render.

A refused address returns 400 BLOCKED_URL.

Your request on its way through#

Your request, including any html, waits in our job queue until a browser is free. Finished jobs are removed from the queue within 5 minutes and failed ones within an hour, so errors can be diagnosed. The rendered result is held for at most 2 minutes while it's handed back to you.

Reporting a problem#

Found a security issue? Write to [email protected]. Please don't test against other customers' data.

Stuck? Write to [email protected] with the request you sent and the error code you got back.