CamsClaw · Trust

Certifications & audits

Sub-processors

Third-party services that may process customer data in the course of providing CamsClaw.

Data handling

• What we collect: scan targets (URLs / hostnames you submit), scan results (HTTP responses to our probes), account info (email, name, password hash, IP at signup), session metadata (IP, UA). For Layer-3 active scans: per-probe audit log retained 12 months. For demo / sales requests: form fields you submit, plus IP-derived city / ISP / ASN / timezone (sales context only — see IP enrichment below).
• What we don't collect: no third-party analytics scripts, no advertising IDs, no fingerprinting. We don't share user data with brokers.
• Encryption: TLS 1.2+ for all in-transit data (HSTS preload roadmap Q3). Database at rest on encrypted volume (Netcup full-disk encryption). Passwords bcrypt-hashed (cost 12). API keys SHA-256 hashed; raw value visible exactly once at creation.
• Retention: scans are append-only and public by default (verifiable history is the product). Owners can opt out a domain via verified ownership — see /about. Account data deleted on request within 30 days.
• Backups: nightly encrypted backups (age encryption), 30-day retention. Off-site copy in separate region.

Security practices

• Public-key-only SSH on all production hosts (no password auth)
• fail2ban with custom jails for failed-auth bursts on nginx + SSH
• Cloudflare proxy with real-IP forwarding; direct-origin filtering enabled
• Rate limits at nginx + application layer; per-IP + per-token budgets
• Pre-push syntax-check git hook + post-deploy health-check + automatic rollback
• Append-only audit log per organization; 1-year retention, CSV exportable
• OWASP-recommended headers: HSTS, X-Frame-Options, CSP, Referrer-Policy, Permissions-Policy
• CSP: default-src 'self'; no inline scripts; no third-party CDN dependencies
• Static-asset CSP nosniff; subresource integrity for any future external scripts

IP enrichment & visitor transparency

CamsClaw enriches visitor IPs to provide useful context — for the visitor themselves (the "Your scanning context" panel on the homepage) and for sales follow-up on demo-request submissions.

• What we look up: country, city, region, postal, timezone, ISP, ASN — derived from your public IP via a third-party geolocation service (ipapi.co). Coordinates returned are city-centroid only (~10 km precision), never GPS-precise.
• For anonymous visitors (homepage, scoreboard, etc.): the enrichment is fetched in real-time and shown back to you in the "Your scanning context" card — not persisted in any database we maintain. The lookup result is cached in memory for 24 hours so we don't re-query the provider on every refresh; that cache holds IP → city mappings, never tied to any user identifier.
• For demo / sales submitters: the same enrichment is stored alongside the demo-request row so the sales rep handling your inquiry has context (e.g. "this lead is from Bangalore on Bharti Airtel"). Retained for the lifetime of the lead conversation; deleted on request.
• For org dashboards: not currently enriched. Org users are identified by email, not by IP.
• Private / loopback / VPN IPs: skipped (no lookup attempted).
• Opt out: setting GEO_PROVIDER=disabled on a self-hosted CamsClaw instance disables this enrichment entirely.

Vulnerability disclosure

Found a security issue in CamsClaw itself (not a finding from a scan)? Email security@camsclaw.ai with a description and proof-of-concept. Our coordinated-disclosure SLAs:

• Acknowledgment: within 24 hours
• Critical / high: triaged within 7 days, fixed within 30
• Medium: triaged within 14 days, fixed within 90
• Public credit: with researcher's permission, in our /.well-known/security.txt hall of fame

Public security.txt: /.well-known/security.txt

Authorization & scope

CamsClaw scans the public-facing surface of websites. Authorization to scan a site is the scanning user's responsibility — we present no presumption of consent. For paid customers, domains added to an Organization must complete Layer-2 ownership verification before deep scans (Layer-2) or active scans (Layer-3) are permitted. Layer-3 requires an explicit, versioned consent ticket per the Terms.

Architecture

• Edge: Cloudflare (TLS termination, WAF, DDoS)
• Origin: nginx on Ubuntu 24.04 LTS (TLS re-terminated for HSTS + custom rate limits)
• App tier: FastAPI on uvicorn + 2 workers, behind nginx reverse proxy in Docker
• Database: SQLite with WAL + foreign keys (Postgres migration Q3 2026)
• Queue: Roadmap — Celery + Redis for async scan dispatch (Q3 2026)
• Observability: Application logs, container logs, fail2ban logs; Prometheus + Grafana on roadmap

For procurement reviewers

Please email procurement@camsclaw.ai for:

• Signed SOC 2 letter from auditor
• Completed SIG Lite / CAIQ / VSA-Q questionnaires
• Cyber liability insurance certificate
• DPA / MSA templates
• Reference customers (with their permission)
• Data residency options (Mumbai / Frankfurt / N. Virginia)

Status & uptime

status.camsclaw.ai — public real-time status + 90-day historical uptime. Currently: operational.