Platform controls
- TLS protects public website and API traffic.
- Authentication tokens are verified at the API boundary and API keys carry endpoint scopes.
- Session cookies are HttpOnly, SameSite Lax and Secure in production.
- Persistent browser-session cookies are encrypted at rest with AES-256-GCM and bound to the owning account, project and session.
- Rate limits, concurrency limits, bounded output sizes and request timeouts reduce abuse and workload exhaustion.
- Request IDs and structured operational traces support investigation without returning internal credentials.
- Production secrets are injected at runtime and are not committed to the repository.
Data minimisation
Plaintext API keys are returned once. Payment-card data is handled by Stripe. Crawl output and browser sessions have bounded retention. Operational request logs are purged after 90 days. Customers can revoke keys and sessions from the console or API.
Shared responsibility
Customers must protect credentials, grant only necessary scopes, validate extracted content before executing it, respect target-site permissions and promptly revoke exposed keys. CrawlVolt output may contain untrusted third-party text and must not be treated as executable instructions.
Vulnerability disclosure
Send reports privately to security@crawlvolt.com with the affected endpoint, impact and reproduction steps. Do not access unrelated customer data, degrade production, run denial-of-service tests or publish an issue before a remediation window has been agreed.
Assurance status
CrawlVolt does not currently claim SOC 2, ISO 27001, PCI DSS certification or a formal uptime SLA. Payment-card processing is delegated to Stripe. Enterprise customers may request architecture and control information through security@crawlvolt.com.