How “no storage” works

Your documents are confidential. We built the service so that we do not keep them, rather than promising that we will handle them carefully.

What we never log or store

• Request bodies, your HTML, header and footer templates.
• The generated PDF.
• Full URLs and query strings.

Rendering happens in memory. Chromium’s temporary files live in a memory-backed volume, so nothing touches a disk.

What we do keep, per render

Only metadata, in a usage record: your account, the key id, the time, the duration, the number of pages, the output size and the status. For renders of a url we store the host name only, to investigate abuse. Usage records are deleted after 13 months, which is the period in which invoice disputes can occur.

Application logs contain metadata and error codes only, never query strings or bodies.

Locked-down rendering

• The renderer runs in its own network namespace and may only reach public web servers on ports 80 and 443. Private, internal and cloud-metadata addresses are blocked, as are our database and other services.
• Inside the browser every request is checked as well: the host is resolved and refused when it points to a non-public address. Only http and https are allowed.
• We also check the url you send before rendering, so you get a clear error instead of an empty PDF.
• The renderer container runs as a non-root user with a read-only file system, has no secrets, no service-account token and no extra capabilities, and runs on a dedicated node.

Sub-processors

Scaleway hosts the service, the database and our transactional e-mail, all in the EU. See the list of subprocessors.