Privacy & security
Plain language, no badges. This describes what the software does today, not what we hope to do.
The short version
- Documents are rendered in memory and sent back in the same response. We don’t write your HTML, URLs, template data or output to disk or to the database.
- Our logs can only hold metadata: key id, time, endpoint, status, size and duration.
- Saved templates are encrypted at rest. API keys and passwords are stored as hashes.
- The dashboard and API have no third-party trackers or analytics.
- Hosting hasn’t been chosen yet. This page will name the provider and region once it has.
We don’t hold SOC 2 or ISO 27001 certificates. If we get one, it will be listed here with the report available on request.
What happens to a request
- The API checks your key (by hash), your rate limit and your monthly quota.
- The JSON body is held in memory and passed to a renderer process running headless Chromium.
- Chromium opens a fresh, incognito browser context: no cookies, cache or storage from any earlier request.
- The PDF or image is produced in memory and streamed back to you.
- The browser context is closed and the memory released. We record one metadata row (see Logs) and increment your monthly counter.
There is no queue, no object storage and no cache in this path. If a render fails, the error message is generic and never echoes your content.
What we store
| Data | Why | How long |
|---|---|---|
| Email address | Log-in, service and billing emails | Until you delete the account |
| Password | Log-in. Stored as a salted scrypt hash | Until you delete the account |
| Idempotency keys (only if you send the header) | Telling a retry from a new request, so retries aren’t charged twice. A keyed hash of the key and of the request, never the key or the body | 24 hours |
| API keys | Authentication. SHA-256 hash plus the first characters for display | Until revoked keys are deleted with the account |
| Saved templates | So you can render them. AES-256-GCM encrypted | Until you delete them |
| Monthly render counts | Quotas and billing | Until you delete the account |
| Request metadata | Usage page, abuse limits, debugging | 30 days |
| Campaign tags (utm_*) from your sign-up link | Knowing which channels work | Until you delete the account |
| Billing details | Held by our payment provider, not by us | As required by tax law |
We don’t ask for your name, company, phone number or address at sign-up.
Getting files elsewhere
There is no option to make pagenull keep an output. If you need the file somewhere other than your own server, pass deliverTo with a presigned upload URL in your own storage. We upload it and keep nothing. Every response also carries pagenull-retention: none and a signed receipt; see trust.
Logs
The application has one logging function and it accepts a fixed list of fields: event name, key id, account id, endpoint, status, bytes, duration and error code. Anything else is dropped before it’s written. Request bodies, HTML, URLs, template variables and IP addresses aren’t on that list. Our automated tests check this.
The homepage playground (no account) is rate-limited by IP address. The address is hashed with a random salt that exists only in memory and changes on every restart; neither the address nor the hash is written anywhere.
Rendering isolation
- SSRF protection. Only
httpandhttpsto public addresses are allowed, for the page and for every image, stylesheet, script and frame it loads. Private ranges, loopback, link-local, cloud metadata endpoints,file://and internal hostnames are refused. As a backstop against DNS rebinding, any response served from a non-public address fails the render. - Per-request switches. Turn off JavaScript, or block every external request, per call.
- Blocked features. WebSockets, service workers, downloads, pop-ups and dialogs.
- Limits. Hard timeouts, input and output size caps, and a concurrency limit per renderer.
- Separation. The renderer runs as its own container with no database access and no credentials other than a token the API uses to call it.
Where it runs
Not deployed yet: the hosting provider and region will be named here once chosen. The full list of companies that process data for us, and where, is on the sub-processors page. Customers can sign our data processing agreement.
Tracking on this website
The dashboard and API pages load no third-party scripts. Marketing pages may use cookieless, self-hosted analytics (page views without identifiers). We run ads on Facebook and Instagram; the Meta Pixel loads on marketing pages only after you click “Accept” in the cookie banner, and “Reject” is just as easy. Campaign tags are carried in the sign-up link, not in cookies.
Your data, your controls
In Account & data you can download everything we hold about you as JSON, and delete your account. Deletion is immediate and removes keys, templates, usage records, and request metadata.
Reporting a vulnerability
Email privacy@pagenull.dev. We reply to every report. Please don’t test against other customers’ data or run volume tests against production.