Security FAQ

Customer data is stored in GCP us-central1 (Iowa) by default. Enterprise customers can specify alternative regions including eu-west1 (Belgium), ap-southeast1 (Singapore), and ap-northeast1 (Tokyo).

Yes, enterprise customers can select their preferred region during onboarding. Contact sales@blazecrawl.dev to configure.

Upon account deletion, all data is permanently removed within 30 days. You receive a deletion certificate confirming the process.

Default retention is 90 days for scraped content. Audit logs are retained for 7 years. Enterprise customers can customize retention policies.

Yes, we perform daily backups with 35-day point-in-time recovery capability. Backups are stored in a separate isolated project.

All data in transit is encrypted using TLS 1.3. We also support TLS 1.2 for backward compatibility.

Yes, all data at rest is encrypted using AES-256. Database encryption uses Cloud SQL CMEK (Customer-Managed Encryption Keys).

Keys are managed via GCP KMS. Enterprise customers can bring their own keys (BYOK) using Cloud HSM.

Encryption keys are rotated every 90 days automatically. We also support manual rotation on demand.

Yes, all backups are encrypted with the same AES-256 standard as production data.

Access is restricted to authorized personnel with documented need-to-know. All access is logged and audited. No standing access to customer data.

All employees require SSO via Google Workspace or Okta, plus MFA (hardware keys or authenticator apps).

Yes, the audit log API (/v1/audit-log) provides detailed logs of all API access and administrative actions.

Yes, we conduct quarterly access reviews to ensure appropriate access levels are maintained.

We support workspace-level RBAC with roles: Admin, Editor, Viewer. Custom roles available for enterprise.

Yes, we are GDPR compliant with a signed DPA available. We notify customers within 72 hours of any breach affecting their data.

Yes, our DPA is available at /dpa. For enterprise accounts, we provide custom DPAs with specific terms.

Yes, we comply with CCPA requirements including the right to delete, know, and opt-out of sale.

SOC 2 Type I in progress (May 2026), SOC 2 Type II observation window started, GDPR/CCPA compliant. See /certifications for details.

Annual pen test summaries are available on request under NDA. Full reports are available for enterprise customers.

HIPAA BAA is on our roadmap for Q3 2026. Contact sales@blazecrawl.dev to be notified when available.

Our current sub-processors are listed at /subprocessors. We notify customers 30 days in advance of any changes.

We notify affected customers within 72 hours per GDPR requirements. Incident response includes containment, investigation, remediation, and post-mortem.

Yes, we maintain a documented IRP with clear escalation procedures. We conduct quarterly incident response drills.

We run a vulnerability disclosure program via HackerOne. Critical vulnerabilities are addressed within 24 hours.

Yes, please report via our vulnerability disclosure program at /vulnerability-disclosure or email security@blazecrawl.dev.

Critical (SEV1) incidents: 15-minute response, 4-hour resolution target. High (SEV2): 1-hour response, 24-hour resolution.

We process: contact information, usage data, authentication credentials, and content you explicitly scrape using our service.

No. Customer data is never used to train AI models. Data is isolated per-workspace and deleted according to retention policies.

Yes, use the API or dashboard to export all your data. We provide JSON, CSV, and NDJSON formats.

We automatically detect and redact PII (personally identifiable information) in scraped content when requested.

Yes, all scraped content is scanned for malware before storage. Suspicious content is quarantined.

We use Google Cloud Platform (GCP) for all infrastructure.

Yes, we use VPC service controls and private networking. Production databases are not internet-accessible.

Yes, we use Cloud Armor for DDoS protection and WAF capabilities.

All APIs require authentication (API key or OAuth). We implement rate limiting, input validation, and output encoding.

Yes, we use Cloud Armor WAF with OWASP Top 10 protection rules.

Yes, we use SIEM integration, intrusion detection, and continuous security monitoring. Alerts trigger within 5 minutes.

Security logs are retained for 1 year. Audit logs are retained for 7 years per compliance requirements.

Yes, our audit log API supports SIEM webhook integration for real-time event streaming to Splunk, Datadog, or Elastic.

We track: API latency (p50, p95, p99), error rates, authentication failures, and anomalous access patterns.

We use automated dependency scanning (Snyk) and update dependencies monthly. Critical CVEs are addressed within 24 hours.

Yes, all critical vendors undergo security assessment before onboarding and annual review.

We use Stripe for payments. Stripe is PCI DSS Level 1 certified.

Yes, all employees complete annual security awareness training and sign acceptable use policies.

Only authorized personnel with documented need-to-know can access customer data, and all access is logged.

Yes, all employees undergo background checks as part of our hiring process.