Security at Skrap.ai

This page lists the security measures that are part of Skrap.ai today. For how we handle personal data, see GDPR and data protection and the Privacy Policy.

Data in transit

• The website, the app and the API are served over HTTPS only, and browsers are told to keep using HTTPS (HSTS).
• Pages send security headers that stop other sites from framing them and browsers from guessing content types.

Accounts and sign-in

• Passwords are stored only as a one-way hash; we can't read them.
• Two-factor authentication with an authenticator app, plus recovery codes you can download.
• Team sign-in rules: team owners can require two-factor authentication for every member, or require members to sign in with Google or Microsoft.
• Sessions: see where you're signed in and sign out any device from Settings → Security.
• Security alerts for a sign-in from a new device, a password change, two-factor being turned off, and an API key being created or about to expire.
• Sign-in and other public endpoints are rate-limited.

API keys

• API keys are shown once, when you create them, and stored only as a hash.
• On paid plans, a key can be limited to an IP allowlist and given an expiry date.
• API requests are rate-limited per key according to your plan.
• Webhooks are signed (HMAC-SHA256 in the Skrap-Signature header) so your endpoint can check they came from us. See the webhooks docs.

Teams and access

• Team members have roles (owner, admin, member); only owners and admins change team settings and the do-not-contact list.
• On paid plans, the activity log records sign-ins, API key and team changes, and downloads, with IP address and browser; entries are kept for 365 days and can be exported as CSV.
• Inside Skrap.ai, staff access is limited to what each role requires.

Your data

• Bulk results are kept for 30 days, then removed.
• You can export your account data or delete your account yourself (see GDPR and data protection).
• The support assistant can read your own account details to answer questions, never other customers' accounts, and it can't change anything.

Report a security issue

If you think you've found a vulnerability, email [email protected] with the details and steps to reproduce. Please don't access other people's data or disrupt the service while testing.