Security overview

This page is the entry point for a security review of Driftstack. It links out to the concrete controls + policy pages; this document is a map, not an exhaustive specification. For implementation details or help completing a security review, reach out to security@driftstack.dev.

Data handling

At rest: All customer data in Postgres is on encrypted volumes (managed by Neon). API key plaintext is never stored — keys are hashed with scrypt (logN=15) at mint time. OAuth client secrets are similarly hashed before storage. MFA seeds are AES-256 encrypted at rest, never written in plaintext.
In transit: TLS 1.2+ enforced on every public endpoint. HSTS is set with max-age=63072000; includeSubDomains; preload — see API security headers for the full set.
Object storage: Customer-generated artefacts that land in Cloudflare R2 use server-side encryption (S3-SSE); underlying objects are never publicly listable. The desktop app's recorder saves streamed session frames locally on the operator's machine; those recordings are not uploaded by the recording workflow. See /docs/recordings for the boundary.
Payment details: Card numbers never reach Driftstack systems. Stripe collects and tokenises them under its own PCI-DSS scope; we keep the token and the billing details that appear on your invoice.
Error reports: Server errors go to Sentry, our error-tracking service (EU region), with personal data scrubbed out first. Request logs record technical detail only — never the body of your request or of our response.
Profile state: Saved browser state for a profile (cookies, local storage, IndexedDB) is stored encrypted in Cloudflare R2. The Mac that runs a session holds it only while the session runs and deletes it when the session ends. The database (EU) holds profile metadata only.

Authentication + authorization

Customer keys are scoped: read / write / account_owner. We default to least-privilege; the dashboard's "create key" flow defaults to read with an explicit checkbox to widen.
MFA (TOTP) is available for every account and required for any operation we classify as "sensitive" — see the dashboard for the per-account toggle. We re-prompt for MFA after 15 minutes of step-up inactivity.
Driftstack staff actions are gated behind a separate staff-only scope that no customer key can hold, and they are not part of the public API.
Every login event + every key mint/revoke is captured in the account audit log; customers can self-serve a full log export.

Network + infrastructure

Driftstack runs primarily in the EU (Hetzner, Falkenstein, Germany). Customer-facing API endpoints are served from the EU region. See /docs/data-residency for the current per-category location and transfer safeguards.
Postgres is managed by Neon (EU) with 7 days of point-in-time recovery. Object storage is on Cloudflare R2: saved profile state and the session archive are stored by Cloudflare in Western Europe, not guaranteed to stay in the EU; avatars and status-page snapshots are in a store that keeps copies in both the EU and the US. Presigned access is location-agnostic.
Customer data egress to non-EU regions is restricted to the companies listed below. That one list is published in full at /trust/sub-processors, and it is the same list the Data Processing Agreement refers to at /legal/sub-processors. See /docs/data-residency for the per-category breakdown.
Rate-limiting is enforced application-side via token buckets (per-account + per-IP); see docs.driftstack.io/reference/rate-limits for the bucket model. DDoS absorption is handled at the CDN edge.

Browser sandbox

Driftstack does not execute customer-supplied script bodies server-side — the API surface is action-based (navigate / interact / wait / capture). Arbitrary script eval is intentionally not exposed.
Each session runs in its own isolated browser that starts fresh; state never leaks between sessions. Persistence between sessions only happens via the customer-managed profile mechanism (stored encrypted in Cloudflare R2).
Per-tier caps on how many sessions run at once are the primary cost-control and abuse-mitigation mechanism; exceeding the cap returns 429 with the concurrency-limit RFC 9457 type.

Sub-processors

The companies below process customer data on Driftstack's behalf. This is the complete list, taken from the register published at /trust/sub-processors — the full record, which also gives the region each company operates in, the data it receives, and the legal basis for any transfer outside the EU. Some entries are engaged only for a specific feature or payment method; the full record says which.

Hetzner Cloud — Compute infrastructure for the Driftstack service.
Neon — Managed Postgres: the whole Driftstack database.
Amazon Web Services — Encrypted off-site backups of our database (S3 object storage).
Cloudflare R2 — Object storage for customer-uploaded profile avatars, encrypted profile blobs, public status-page snapshots, the archive of session records older than 90 days, and raw support email (messages and attachments) in a bucket with EU jurisdiction.
Cloudflare Email Routing / Workers — Receives every message sent to a @driftstack.dev or @driftstack.io address and passes it to the support inbox.
Cloudflare Turnstile — Turnstile (a bot check on our sign-up, sign-in and account-security pages and the visitor support chat).
Postmark — Transactional email (signup verification, password reset, billing notifications, support correspondence).
Sentry — Error monitoring for the Driftstack service.
Stripe — Payment processing, subscription management, and VAT handling via Stripe Tax (VAT where it applies; the reverse charge only for business customers in an EU country other than Driftstack's, with a valid VAT number).
Confirmo Limited — Crypto payment processing: the hosted payment page, the payment address and the payment notices for crypto orders.
Anthropic — Large language model (LLM) behind the optional AI agent feature.
MacStadium — Mac hardware hosting for iPhone Safari sessions.
Green Mini host B.V. — Mac hosting for a serving machine that can run Sessions: when a Session runs on it, it holds the Session's browser profile (cookies and site storage) while the Session runs and deletes it from the machine when the Session ends, carries the Session's page traffic to the egress proxy, sends the live view, runs the task or steps the Session is given, keeps input-timing data without the keys typed (up to 7 days), and keeps a technical log of Session events (Session ids, addresses visited, timings).

Section 3.4 of the Data Processing Agreement sets when adding or replacing a sub-processor takes effect and, after Launch, how we give notice of it: a dated notice on the sub-processors page, and by email as well if you ask at privacy@driftstack.dev.

Audit + observability

Two log streams are customer-readable:

Account audit log — every mutation on your account (key mints, profile changes, billing events), in the Driftstack dashboard.
Session activity — the pages visited in your agent sessions, per profile, via the API (GET /v1/profiles/:id/activity).

Incident response

See /docs/incident-policy for the disclosure timeline + the status page cadence. If a personal-data breach affects you, we tell you without undue delay, aiming for within 48 hours.

Vulnerability reporting

Email security@driftstack.dev with the details. We respond within 1 business day. Our vulnerability disclosure policy covers safe-harbour for good-faith research; please review it before testing.