How webcapture handles your data
This page is the control list: what the service stores, how secrets are handled, which subprocessors touch data, and which certifications exist. It is not a compliance certification, and it does not try to sound like one; each claim names the source file it was checked in.
Keys and access
API keys are stored as SHA-256 hashes; the plaintext is shown once at mint and never kept, and the dashboard works from a short prefix (ids.ts, keys.ts). There are no passwords: signing in runs through Google or a one-time email code (auth.ts), the code is kept only as a peppered digest, expires in minutes, and five wrong guesses consume it. Authentication-relevant events, including a rejected bearer and a successful master-key use, land in an append-only audit log. Subjects are id-shaped digests or the fixed labels master, api, and session, never a raw email, code, bearer, or key (auditlog.ts).
Webhooks attach per key, and each configured key carries its own signing secret, shown once when the webhook is saved (keys.ts). Setting a new webhook rotates the secret, so a stale endpoint cannot read deliveries meant for the current one.
Renders and artifacts
Every render URL is resolved through DNS and refused when it lands in a private address range, and the verdict is re-checked on each request the browser makes while the page loads, failing closed (ssrf.ts). URLs with embedded credentials are refused outright, and the resolver itself is time-boxed so a slow DNS answer cannot stall admission.
Rendered files are kept on this service's own disk (pdfstore.ts, written owner-readable only) and deleted automatically after 7 days, the default retention the config ships with (config.ts). There is no credential-backed export: a destination request pushes the finished bytes to its caller-signed presigned PUT URL only (destination.ts), the service stores no cloud credentials, and without a destination the code ships an artifact to no bucket, vendor, or CDN, so a render lives on this disk until retention removes it.
Your pipeline
A completed render POSTs one JSON event to the key's webhook, signed with X-WebCapture-Signature: t=<ts>,v1=<hex>, the HMAC-SHA256 of <ts>.<body> keyed with that key's secret (webhooks.ts). Delivery endpoints must be https, and redirects are not followed: the delivery fetch refuses to follow them, so a receiver cannot bounce the POST somewhere private after its host was vetted.
Subprocessors
Six providers act as pipes for your data: Google (sign-in identity, and Google Analytics page-view and interaction-event measurement on public pages when configured), Resend (one-time codes and account email), Stripe (billing, once live), OVHcloud (hosting, in Singapore) with Cloudflare (network, and the bot check on sign-in and the free tool), Sentry (error and performance monitoring in production: crash reports with stack traces and coarse request metadata, a sample of request traces, and the same from a signed-in dashboard session. Not advertising or product analytics), and PostHog (product analytics, EU-hosted: counts events like sign-ups and renders, sent from our own server with no cookies in your browser, no IP addresses, and accounts appearing only as opaque ids). None of them owns a product function. The data-lifecycle statement around this list is the privacy policy.
Compliance, stated as gaps
No row below is a certification. Each states what exists today and what is missing, so a buyer can plan around the facts instead of a badge wall.
| framework | status today | what is missing |
|---|---|---|
| SOC 2 | not started | no auditor engaged, no readiness assessment, no evidence collection; the first report would follow months of evidence work after an auditor is hired |
| HIPAA + BAA | Not offered (prerequisites: signed BAA chain covering every subprocessor that touches render content, breach-notification runbook, annual risk assessment; none exist today). A phi rendering mode (zero residue) is shipped; it activates only for accounts under an executed BAA. | the three prerequisites themselves: the BAA chain, the breach-notification runbook, and the annual risk assessment; until all three exist, rendered content must not include protected health information |
| GDPR | privacy policy and subprocessor list published; DPA on request via email | a click-to-sign DPA published beside the privacy policy; today the agreement is answered over email instead |
Method
Checked 2026-10-18 against the running code (file citations above). Questions: hello@webcapture.io.
Render your first page in seconds
Mint a key, POST a URL, and the finished document comes back in the same response; pass ?wait=false for a job ticket with poll and download URLs. The first 50 renders a month are free, and there is no credit card. Not ready for a key? The free URL to PDF tool renders public pages without one.