Security and privacy at PinSay

Where your data lives

• PinSay Cloud runs on Oracle Cloud in the Riyadh region (Saudi Arabia). Accounts, comments, screenshots and bug reports are stored there.
• Transactional e-mail is sent through Brevo (EU). Integrations send only to the destinations you connect.
• Prefer your own network? PinSay also runs on-premise on your own server: a Docker Compose package that works offline and needs a licence file from PinSay.

Each workspace is separate

• Every database query is filtered to the workspace making it, so one workspace never reads another's comments, projects or files. In production, a record without an owner workspace is visible to no one.
• Private comments are visible only to the person who wrote them. Everyone else sees a count, and private comments are never sent to integrations.
• An append-only audit log records admin actions: who did what, and when. The IP address is stored only as a keyed hash, and the database refuses to edit or delete audit entries.

Accounts and sign-in

• Passwords are hashed with bcrypt. We never store them in plain text.
• A password must be 10 to 128 characters, can't be one of the 10,000 most common passwords, and can't be your e-mail address.
• New passwords are checked against known data breaches with Have I Been Pwned. Only the first 5 characters of the password's SHA-1 hash leave our server, never the password itself.
• After 10 failed sign-ins for one e-mail address within 15 minutes, further attempts are refused for a while.
• Sign-in, sign-up, password changes, comments, uploads and invites are rate-limited. For example, sign-up allows 5 attempts per hour per IP address.
• Sessions expire after 12 hours. Disabling an account or changing its password ends its open sessions.

Secrets and API keys

• The credentials you give integrations (webhook URLs, chat bot tokens) and speech-to-text keys are encrypted with AES-256-GCM before they are stored. The encryption key lives only in the server's environment, never in the database.
• API keys are stored hashed for sign-in and encrypted for display, so a copy of the database alone gives no usable key. You can replace your key at any time.

What the widget captures

• A comment carries the element's selector, its CSS rules, the route, the viewport and a snapshot of the element.
• Form values are never kept in the snapshot. Password fields, and anything you mark with data-snapshot-mask, are masked, and the server checks every snapshot again.
• Page text is captured by default; an admin can turn it off for any project.
• Console and network capture for bug reports is off until you turn it on for a project. Secrets in headers and fields (authorization, cookies, tokens, passwords, API keys, card numbers) are replaced with [REDACTED] in the browser, before anything is uploaded.

Integrations

• Requests PinSay sends to the URLs you configure (webhooks, Slack, Discord, Telegram, Microsoft Teams, GitHub) refuse private, local and cloud-metadata addresses. The address is checked when the connection opens, and redirects are never followed.
• Webhook deliveries are signed with HMAC-SHA256 in the X-PinSay-Signature header, so you can verify they came from PinSay.
• A workspace admin can switch integrations to metadata only. Notifications then carry no comment or reply text.

Keeping and deleting data

• A plan can limit how long comments are kept. When a limit applies, the workspace admin gets an e-mail notice, a reminder and a final 24-hour warning before old comments are deleted, and a daily job deletes them.
• Operational data is pruned automatically: integration delivery logs after 14 days, read notifications and old invites after 90 days, usage events after 180 days.
• An admin can export a workspace or a project as JSON, and can delete the workspace: it is erased after a 7-day grace period. Anyone can erase their own account.

Backups

• The database is backed up every night and before every deploy. A deploy is refused when the newest backup is more than 26 hours old.
• Backups and uploaded files are copied off the server to separate storage and kept for 30 days.
• We rehearse restoring from the off-server copy.

Connections

• Every PinSay site uses HTTPS with automatically renewed certificates and HSTS. Responses send security headers that stop content-type sniffing and limit framing, referrers and browser permissions.
• We publish a security.txt file at /.well-known/security.txt.

Privacy law

• Our privacy policy sets out your rights under Saudi Arabia's Personal Data Protection Law (PDPL) and, if you are in the EEA, under the GDPR: access, correction, deletion and portability of your data.

What we don't offer yet

Report a security issue

Found a vulnerability? E-mail support@pinsay.dev with the steps to reproduce it. Please give us time to fix it before you share it publicly.