Documentation

Appearance

Data security ​

This page describes how we protect the data that you share with us.

Encryption ​

All data is encrypted in transit (HTTPS/TLS) and at rest (AES-256).

Infrastructure ​

Capture.dev runs on secure infrastructure from established cloud providers. Our infrastructure providers maintain independent security certifications and audit reports.

  • Application and database: hosted with Render.com in Frankfurt, Germany. Render.com is SOC 2 Type II audited and ISO/IEC 27001 certified. (Learn more)
  • Attachments (screenshots, recordings and captured technical data): stored in Amazon Web Services (AWS) S3 in London (eu-west-2). AWS is ISO/IEC 27001 certified, maintains PCI DSS Level 1 Service Provider compliance, and participates in the Cloud Security Alliance (CSA) STAR programme. (Learn more)

Access control ​

  • Multi-factor authentication (MFA) is enforced on all cloud provider and administrative accounts.
  • Services and credentials have only the permissions they need to do their job (least-privilege access).

Data retention and deletion ​

  • Bug reports and their attachments are kept for 24 months by default while a customer account remains active, after which they are automatically deleted. This retention period can be adjusted on request.
  • Following account termination or expiry, Customer Personal Data is returned or deleted in accordance with our Data Processing Agreement.
  • When data is deleted, it's removed from our database straight away and from database recovery points within 7 days.

Monitoring ​

We use a third-party monitoring tool (Sentry) to monitor application errors so that we can detect and respond to problems quickly.

Incident response ​

If we become aware of a security incident affecting your data, we'll notify you without undue delay, and in any case within 72 hours. We'll tell you what happened, what data was affected, and what we're doing about it.

Hiding sensitive data ​

Capture.dev includes built-in safeguards that automatically redact certain types of sensitive information from bug reports. Customers can also configure additional redaction rules to prevent other information specific to their applications from being captured.

Redaction takes place client-side, in the user's browser, before the affected data is transmitted to Capture.dev. This means that information successfully removed or masked by these redaction rules is not included in the data sent to our servers.

How we share data ​

We use a small number of trusted third-party providers (sub-processors) to run Capture.dev. We share data with them only to provide our service. We never sell your data or share it with third parties for marketing or advertising.

The full list of these processors can be found in our privacy policy.