Skip to content
Pageteer

Security

Security, built into the API.

A short overview of how we protect your keys and account, keep each team's data separate, and keep the API from being turned against anyone.

  • API keys

    An API key is shown once, when you create it. We store only a SHA-256 hash and a short prefix, so a database leak does not reveal usable keys. A revoked key stops working within a minute.

  • Accounts and sessions

    Passwords are hashed with Argon2id. Sessions live in an encrypted, HTTP-only, SameSite cookie and can be revoked everywhere at once. Sign-in, sign-up and email flows are rate-limited.

  • Tenant isolation

    Keys, usage, logs and crawl jobs are scoped to your team on the server, and membership is re-checked on every request. Nothing sent from the browser chooses whose data you see.

  • SSRF guards

    Requests to private, loopback, link-local and internal addresses are refused in the API gateway and again in the rendering engine, which runs on a private network only.

  • Your proxy credentials

    If your team brings its own proxy, its URL and credentials are encrypted with AES-256-GCM, bound to your team, and write-only: never shown back in full and never logged. Proxy hosts on private networks are refused.

  • Rate limits and abuse controls

    Per-key and per-team rate limits and concurrency caps, per-target-host throttling, a denylist of sensitive site categories, and abuse signals that flag accounts for review.

  • Web app hardening

    A nonce-based Content Security Policy, strict security headers, same-origin checks on state-changing requests, and HTTPS everywhere (HSTS).

  • Payments

    Card details are handled by Stripe and never touch our servers. Billing webhooks are signature-verified and processed idempotently.

  • Data minimization

    Request logs keep target URLs or search terms, status, credits and timing for 30 days, never page bodies. Team roles limit who can manage keys and billing, and key and billing actions are recorded in an audit log.

Reporting a vulnerability

If you believe you have found a security issue, please email security@pageteer.dev with the details. Please give us a reasonable chance to fix it before disclosing it publicly. We will not take action against good-faith research that avoids privacy violations and service disruption.

Reporting abuse

If Pageteer is being used against your site or in breach of our Acceptable Use Policy, email abuse@pageteer.dev with the affected host, the times and, if you have them, the request ids. We can add your site to our denylist.

For how we handle personal data, see our Privacy Policy.