Security
Built to have little worth stealing.
The safest data is data you never keep. Punchline doesn't store IP addresses, user agents, cookies or anything typed into your site, and what it does keep is protected as below.
What's stored
About your visitors
- No IP addresses or user agents. They're used in memory to classify a request, then discarded. Logs strip them automatically, and tests check it.
- No cookies, local storage or persistent IDs on visitors' devices. A daily hash groups a visitor's requests within one day; its salt is deleted daily.
- No form contents, search terms or request bodies, and no session recordings or keystrokes.
- Retention: individual page-view records for 90 days; daily totals are kept. Privacy
Where it lives
Hosting and providers
The app and website run on Vercel; the database is Supabase on AWS in the United States (Oregon). EU hosting is planned. Every provider that processes data for us is listed with what it does. Subprocessors
Everything travels over HTTPS. The API accepts HTTPS only, and sends no CORS headers, so it can't be called from a web page.
Access
Who and what can reach your data
- Roles on every site: owners, admins and viewers, checked on every action. A site can never lose its last owner. Your team
- Least privilege inside: the app reaches the database through a restricted role that can't delete events, change tables or read sign-in data, and tests check it can't.
- Secrets stored as fingerprints: API keys, share links and invite links are stored only as SHA-256 hashes, so a database copy doesn't contain working credentials.
- Credentials you give us (CRM, ad platform and Snowflake keys) are encrypted before they're stored, and never shown again.
- Outbound requests only reach public addresses: webhook and audit URLs are checked against private networks before every request.
- Outside your dashboard, in the API, MCP, exports and share links, groups of fewer than 5 people are withheld, and people's sessions are never returned.
Paperwork and problems
Questionnaires, agreements and reports
Need a security questionnaire answered or a data processing agreement? Email hey@opsscale.co.
Found a vulnerability? Please tell us at hey@opsscale.co before telling anyone else, and give us a reasonable time to fix it. We'll reply, keep you posted, and credit you if you'd like.