Security and data handling

How requests are processed, what is recorded, and what is never kept. This page describes the running system; the legal commitments are in the privacy notice and the terms.

Where processing happens

• The API and the website run on Oracle Cloud Infrastructure in Jeddah, Saudi Arabia (me-jeddah-1).
• TLS ends on that server. There is no CDN, proxy or other service between your application and the renderer.
• Content sent to the API does not leave Saudi Arabia, except when you ask the renderer to load a page or resource hosted elsewhere.

What is never stored

• The HTML, URLs and parameters you send.
• The PDFs and images produced.
• Cookies and data of the pages rendered.

Each request runs in its own browser context, in memory, which is discarded when the response has been sent. There is no cache and no temporary file.

What is counted

For each API key, the number of successful renders in the current month, to apply your plan's allowance. Nothing about their content.

What is logged

For each request: the HTTP method, the path without parameters, the status code and the duration; for an unexpected error, only its type. Not logged: URLs, query strings, API keys, IP addresses, headers or content. The log has a fixed maximum size and overwrites itself.

Isolation of the renderer

• Every request of the page being rendered (the page itself, images, scripts, frames) is checked. Private, local and link-local addresses are refused, including the cloud metadata service.
• A network firewall blocks the same addresses a second time, so a DNS rebinding trick cannot reach them.
• The browser runs with its own sandbox: each page is rendered in a separate, restricted process that cannot read other processes or files.
• A firewall inside the container stops the browser from connecting to the container itself, so a redirect or DNS trick cannot reach the service it runs next to.
• The browser process does not receive API keys or other secrets in its environment.
• The renderer runs in a container without root rights and without extra privileges, with limited memory and CPU.
• Downloads are disabled, and each request gets a fresh browser profile.

For your compliance team

On the Compliance plan we sign a data processing agreement with you and provide a data residency letter describing this setup for your auditors. The service is suited to requirements such as the SAMA rules on outsourcing and the Personal Data Protection Law; whether it meets your obligations is for your compliance function to decide, and we will answer their questions. Write to support@sahifa.dev.

Reporting a security issue

Please write to support@sahifa.dev with the subject "Security". You will get a reply within one business day.