Security Architecture & Data Retention

Because FlyCrawl fetches external URLs on behalf of users, our network pipeline implements strict DNS-level and socket-level SSRF safeguards before any outbound connection is established:

• DNS Resolution Validation: Hostnames are resolved to target IPs prior to socket connection. If any resolved IP points to a disallowed subnet, the request is immediately rejected.
• Blocked Private & Internal IP Ranges: Outbound workers block 127.0.0.0/8 (loopback), 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 (RFC 1918), 169.254.0.0/16 (link-local), and IPv6 equivalents (::1, fc00::/7, fe80::/10).
• Cloud Metadata Endpoint Shielding: Requests attempting to query instance metadata services (169.254.169.254, metadata.google.internal) are blocked and flagged.

FlyCrawl applies cryptographic best practices to API credentials:

• SHA-256 Hashing at Rest: API secret keys are never stored in plaintext. They are cryptographically hashed using SHA-256 upon generation. Only the hash is persisted.
• One-Time Secret Display: Users are shown their raw API key only once at creation time. If lost, keys must be revoked and regenerated.
• Instant Revocation: Users can revoke compromised API keys immediately from their dashboard with instantaneous global invalidation.

FlyCrawl operates strictly as a real-time data ingestion conduit, not a permanent archive. Our storage lifecycle policy enforces automatic data deletion:

• Automatic 72-Hour Purge: Cached responses, intermediate page contents, screenshots, and extracted markdown are purged permanently after 72 hours.
• Zero Data Monetization: We never inspect, train models on, share, or sell customer crawl results or URL payloads.

All communications with FlyCrawl APIs and dashboards require HTTPS enforced with TLS 1.2 or TLS 1.3. Plaintext HTTP requests are rejected or redirected to encrypted channels with modern cipher suites.

We welcome responsible disclosure from security researchers. If you identify a vulnerability in our infrastructure or APIs, please contact our security desk:

We commit not to take legal action against security researchers who conduct testing in good faith, avoid service disruption, and give us reasonable time to remediate before public disclosure.