Found a security problem in Crawl4AI? Write to security@crawl4ai.com. The CEO reads this mailbox.
The endpoint or page, the steps to reproduce, and what you saw. A short script beats a long description. Do not send us other people's data.
Every connection to the API uses HTTPS with TLS 1.2 or 1.3. API keys are stored only as a SHA-256 hash: we cannot read your key after we show it to you once. Database backups are encrypted with AES-256 before they leave the server.
The service runs in three regions: European Union (Germany), Singapore and United States. Your account, usage and billing records are stored in the EU region only. The other regions serve requests and hold no account data. Payments are handled by Stripe; we never see or store card numbers.
Access to systems that hold customer data is limited to the people who run the service, uses multi-factor authentication on every service, and is reviewed every quarter. Administrative access to servers uses SSH keys over a private network only. No database is reachable from the internet.
The accounts database is backed up every day to object storage in a different data center, with a second weekly copy at another provider. We test a full restore every six months. Our recovery targets for the accounts database are 4 hours to restore and at most 24 hours of data loss.
Servers receive security updates automatically. Dependencies are watched for known vulnerabilities. Every code change is reviewed before release, released one region at a time, and can be rolled back.
We use the pages you fetch and the instructions you send only to answer your request. We do not sell customer data, and we do not use your request content to train models.
Third parties that process customer data for us, and what for. We update this list before a new subprocessor receives customer data.
A Data Processing Addendum is available on request at hello@crawl4ai.com.
Crawl4AI is working towards a SOC 2 report with an independent auditor. Our security policies cover access control, change management, incident response, backups, vendor management and the use of AI tools. We follow the Singapore Personal Data Protection Act and, for customers in the European Union, the GDPR. Enterprise customers can ask for the current state of the audit and copies of our policies at hello@crawl4ai.com.