Encryption at rest
AES-256-GCM for provider credentials
Every provider credential you upload is encrypted with AES-256-GCM before it reaches our database, using a key held server-side. What the database stores is ciphertext.
Security posture
Trust & security
Plain English. No theater. Everything below describes what runs in production today, and each statement traces back to something in our codebase or our infrastructure. If we cannot point at it, it is not on this page.
Encryption in transit
HTTPS on every public endpoint
The API, the dashboard, and this site are served over HTTPS. Webhook deliveries from the BI console are signed with HMAC-SHA256, so you can verify a payload came from us before you trust it.
Authentication
bcrypt at cost 12, signed JWT sessions
Passwords are hashed with bcrypt at cost factor 12. Sessions are signed JWTs. API keys carry an sr_live_ prefix, are scoped to a single organization, and can be revoked at any time.
Tenancy
An org id on every row and every query
Every tenant table carries an organization id, and every repository query filters on it — so asking for a record that belongs to another organization returns nothing rather than the wrong row. Queued work is grouped per organization.
Backups
Nightly dumps, plus a second daily copy
The core database and the extraction store are dumped nightly to object storage and kept for 14 days. A second daily dump of the core and analytics databases lands on separately operated hardware, which keeps the newest seven of each.
Audit
Sign-in and account events, kept 90 days
Registration, sign-in, password resets, account export and deletion, and organization switches are recorded with the actor, a timestamp, and an IP address. Entries are retained 90 days by default. That is the current coverage — it does not yet extend to every configuration change.
Credentials model
Bring your own accounts, or run on ours
Bring your own vendor accounts and your relationship with Bright Data, Oxylabs, Nimble Way, Zyte, and Decodo stays governed by their terms. Managed mode instead runs scrapes on JustCrawl platform accounts and bills your organization in credits. Where you have supplied credentials for a vendor, those are the ones used.
Error hygiene
Internal error text stays out of API responses
API error responses carry a generic message or a documented error code rather than the underlying error text. The one exception is a syntax error in the SQL console, where the database reports the position in the query you typed. Exception telemetry forwards a fixed set of identifiers, and never request bodies, job payloads, or extracted content.
Retention
Scraped bodies expire after 90 days
Scraped page bodies expire 90 days after capture by default and stop being served once they do. Organizations that deliver results to their own object storage choose their own expiry, anywhere from one day to ten years.
Procurement
Security questionnaire or DPA?
Email hello@justcrawl.io with “Security questionnaire” in the subject line and attach your document or list your questions. Our handling of personal data is set out in the privacy policy.