Security
How Revecto handles your data and keeps renders safe.
Transport
The API is served over HTTPS only, and HTTP requests are redirected to HTTPS. HSTS is sent for one year, subdomains included.
API keys
A key is shown once, when you create or roll it, and is stored only as a one-way hash. Disable, roll or delete a key at any time; see Authentication.
Documents and templates
| Data | Handling |
|---|---|
| Documents and PDFs | Processed in memory, not stored. |
| Templates and their assets | Stored until you delete them. |
Each account's keys, templates and files are separated from other accounts'.
Call log
Each call records:
| Field | Content |
|---|---|
| Endpoint | The endpoint called. |
| Status | The HTTP status of the response. |
| Duration | How long the call took. |
| Sizes | The size of the HTML and of the PDF. |
| Request id | The X-Request-ID of the call. |
| Engine | The engine used. |
| Error | The error code and message, when the call failed. |
| Skipped resources | The number of skipped resources, with up to ten reasons and URLs (without query string). |
| Time | When the call was made. |
It never contains your document or the PDF.
Rendering
| Area | Behavior |
|---|---|
| Scripts | Chromium does not run them. |
| Remote resources | Fetched by Revecto, not by the renderer, under fixed limits. See Remote resources. |
Chromium sessions
| Area | Behavior |
|---|---|
| Session | Each project gets its own browser session; no other project or customer renders in it. |
| Network | The browser makes no network request. Remote resources are fetched by Revecto before the render; see Remote resources. |
| Lifetime | A session closes after five minutes without a Chromium render of the project. |
Where data lives
Each project has a region, fixed when you create it, and the host of that region; see Regions. For subprocessors, locations and how long data is kept, see the privacy policy.
Error reports
Reports of errors in Revecto carry no request data or headers. A user appears in them only as an id.
Report a vulnerability
Email support@revecto.dev.