ProofSnap API Security and EU Data Residency

What happens to your data in a capture

A single capture through the ProofSnap API or dashboard goes through five steps:

You submit a URL over HTTPS, either through the API with your API key or from the dashboard.
A browser on ProofSnap servers in Frankfurt loads the page. It connects only to public addresses. In live mode the URL is also sent to the Internet Archive, unless you turn that off.
Every file is hashed with SHA-256 and the manifest is signed. Only the manifest hash goes to the OpenTimestamps calendars and, if you request a qualified timestamp, to Disig a.s.
The sealed package is stored encrypted in Frankfurt, with a second copy of live packages in Ireland.
You download it, or receive a signed webhook when it is ready.

Where it runs

API: Amazon Web Services in the EU, Frankfurt (eu-central-1).
Account and capture records: Google Cloud Firestore in the EU, Frankfurt (europe-west3).
Sign-in: Firebase Authentication, a global Google service.
Evidence packages: Amazon S3 in the EU, Frankfurt (eu-central-1), with a second copy in Ireland (eu-west-1) of every package made in live mode.

What is processed outside the EU

Evidence packages and capture records stay in Frankfurt and Ireland. Only the following limited data may be processed by services outside the EU:

The captured URL, which is sent to the Internet Archive by default for live captures (you can turn this off).
The manifest hash, sent to the public OpenTimestamps calendars. No file content is sent.
The hostname of the captured site, resolved through Google Public DNS and Cloudflare DNS and looked up in public RDAP and WHOIS services.
Sign-in data in Firebase Authentication and payment data at Stripe.

Server-side capture

The page is loaded and captured on ProofSnap servers, not on your computer. You send a URL and receive a sealed evidence package. The capture browser connects only to public addresses: private, loopback and cloud metadata addresses are refused, even after a redirect.

By default, when a capture is made in live mode, its URL is also sent to the Internet Archive (web.archive.org) so that an independent public snapshot can be created. URLs that look private, such as sign-in, password-reset and share links, or that carry a token, are never sent, and a URL with a query string is sent only when you set the capture option external_archive to true. Set it to false to turn off archiving entirely. The package records the outcome.

How every package is sealed

Hashes: Every evidence file in the package is hashed with SHA-256 and listed in manifest.json.
Signature: The manifest.json file is signed with an RSA-4096 key generated for that package alone. The private key is discarded after signing, and the public key ships in the package.
Bitcoin timestamp: The manifest hash is submitted to OpenTimestamps calendars for anchoring on the Bitcoin blockchain. Once the anchor is confirmed, the completed proof is stored alongside the package. If no proof can be added, the package records this.
Qualified timestamp: If you request one (live keys only, billed per stamp), a qualified electronic timestamp (RFC 3161) is obtained from Disig a.s., a Qualified Trust Service Provider on the EU Trusted List. If no timestamp can be added, the package records this.
Offline verification: Every package includes verification scripts (verify.sh for macOS and Linux, verify.ps1 for Windows) that check it offline, without relying on ProofSnap.

Issuance ledger

ProofSnap records the hash of each manifest it issues. Anyone can look up a hash with GET /v1/ledger/{hash}; a match confirms that ProofSnap issued that exact package.

Second copy

Every evidence package made in live mode is copied to a separate Amazon S3 bucket in another EU region (Ireland). GET /v1/captures/{id} reports the status of the copy for each capture. The copy is deleted together with the original.

Retention

Evidence is kept for 10 years from the date of capture. For a page captured on a schedule, the period runs from the last time the captured version was known to be current:

Every check that finds the page unchanged extends the retention period of the current capture.
For a capture replaced by a newer version, the period runs from the moment it was replaced.

After a subscription ends, you have 30 days to download everything. The “Archive only” plan keeps the evidence readable, downloadable and verifiable after you stop capturing.

Deletion

A package you delete in the dashboard or through the API first goes to the trash, where it can be restored within 30 days. After that, every stored version is removed from both copies. Deleting a package permanently removes it immediately. When the retention period ends, or when an account’s 30-day download window closes, every stored version is removed in the same way. A capture under legal hold cannot be deleted while the hold is in place. A record of who deleted the package and when is kept, but not its content.

Access control

API keys: Stored only as SHA-256 hashes. The full key is shown once, when it is created. A revoked key stops working within 60 seconds. On the Website Archive plan, API keys are read-only: they can list, download and verify captures and manage webhook subscriptions. On that plan, captures and schedules are started in the dashboard.
Dashboard sign-in: Firebase Authentication. A confirmed email address is required before you can create keys, start captures or buy a plan.
Access history: When anyone other than the author of a capture, such as a company owner or a matter member, downloads, verifies or otherwise accesses it, that access is logged on the capture.
Rate limits: Capture, certification and other billable requests are rate limited per account, across all of its keys.

Encryption

In transit: All API, dashboard and webhook traffic uses HTTPS (TLS).
At rest: Evidence packages are encrypted with AES-256 (Amazon S3 server-side encryption) in both buckets. Both buckets block all public access.

Webhooks

Signing: Webhook deliveries are signed using the Standard Webhooks scheme with HMAC-SHA256. Deliveries to a webhook_url set on a request or schedule are signed with the signing secret of the API key that set it. That secret can be rotated with a 24-hour overlap. An account webhook subscription has its own signing secret, shown once when the subscription is created.
Destinations: Deliveries go only to public HTTPS endpoints. The address is resolved and checked again before every delivery, and the connection is made only to the checked address, so private, loopback and cloud metadata addresses are refused even after a DNS change. Redirects are not followed.
Retries: A delivery that times out, fails to connect or receives an error response (other than 410 Gone) is retried up to 5 times over about 35 hours (after 5 min, 30 min, 2 h, 8 h and 24 h) with the same webhook-id, so receivers can discard duplicates. Each attempt waits at most 10 seconds for a response.
Downloads: Retried deliveries and subscription deliveries do not include the 24-hour download link. The receiver can fetch a new one with GET /v1/captures/{id}.
Subscriptions: An account webhook subscription is disabled when its endpoint responds with 410 Gone, after 5 days with no successful delivery, or, if it was created with an API key, when that key is revoked. Events are kept for 30 days and can be retrieved with GET /v1/events.

Third-party services

Payments: Payments are processed by Stripe. ProofSnap does not store card numbers.
Account emails: MailerSend sends the email confirmation and password-reset messages.
Timestamps: The OpenTimestamps calendars and, for a qualified timestamp, Disig a.s. receive only the hash of the manifest, never the evidence itself.
Site lookups: To document the captured site, its hostname is resolved through Google Public DNS and Cloudflare DNS, and its domain registration is looked up in public RDAP and WHOIS services.

ProofSnap API security and EU data residency