Security & your data

What Harpoon stores#

• Anonymous analyses: nothing is persisted — the report is computed, returned, and gone.
• Saved analyses: the engine's result — findings, score, timings, and the request timeline (URLs, domains, sizes). Your capture itself is held only while it is being analyzed.
• Every capture is redacted before it is stored, uploads included. Authorization, Cookie and Set-Cookie headers, API-key headers, cookie lists, request bodies and response bodies are all stripped on arrival — so the copy we keep cannot carry your session tokens or the contents of your pages. The engine reads none of those fields, so nothing in your report changes.
• What remains is deleted as soon as the analysis finishes — usually within seconds — whatever your plan. The derived analysis (findings, score, timings) is unaffected and stays for your history and trends; only the raw file goes, and nothing needs it afterwards: comparing two runs works off the derived record, so an analysis stays a valid baseline for as long as you keep it. Paid plans' longer history retention governs how long the analysis itself is kept — see plans.

What the AI model ever sees#

One rule governs every model call: the deterministic engine discovers findings, the model only explains them. It receives the engine's findings, score, and page metadata — and nothing else: no request or response bodies, headers, cookies, or free-typed user text. The API key exists only server-side behind a single gateway with per-organization rate limits, a monthly spend cap, prompt redaction, and an audit log. Details in the AI report guide.

How secrets are handled#

• Capture credentials and SCM tokens are sealed with AES-256-GCM at rest and are write-only — no API returns them, no page displays them, no log prints them. You can only overwrite or delete them.
• Every capture is redacted before storage — captures additionally run a leak guard that scans capture output for vault values and aborts rather than persisting one that still contains a secret.
• Request logs scrub Authorization and Cookie headers and mask share-link tokens; report bodies and capture content are never logged.

The capture browser#

The browser that captures pages visits URLs users choose, so it's treated as hostile territory: it runs as an unprivileged user with Chromium's sandbox on, is refused access to localhost/private/metadata addresses on every request hop, and is capped in count and memory so it can't exhaust the host.

Deleting your data#

Deleting an analysis removes its stored capture, report, exports, and any public link pointing at it. For full organization/account deletion, email support via the docs hub contact — a self-serve deletion flow is on the roadmap.