Security

Security and data handling

Last updated: September 2, 2026 · Version 2026-09-02

The short version: your screenshots are processed on your own device and are not uploaded. The rest of this page explains what that means in practice and what we do hold.

Where the work happens

Import, hashing, stitching, redaction, text recognition and PDF writing all run as JavaScript in your browser tab, several of them inside Web Workers. There is no upload step in that pipeline and no server copy of your images to protect, subpoena or lose.

  • Cases are stored in IndexedDB, the browser's local database, on that device only.
  • Clearing site data deletes them, because they exist nowhere else.
  • The Wipe this device control in the app clears them immediately.

The two deliberate exceptions

Nothing leaves the browser unless you press a button that says it will. There are exactly two such buttons.

  • Email delivery (Professional). The PDF is uploaded so the mail provider can attach it, then deleted after delivery. We log the recipient's domain, not the full address.
  • AI Packet Review (Professional). Only structured metadata you see on screen before sending is transmitted: counts, gaps, page settings, redaction labels. No image bytes and no message text. Providers are contractually barred from training on it.

Timestamp receipts

We sign the fingerprint; we never receive the file. Your browser computes a SHA-256 fingerprint locally and sends only that value. Our server signs the text fingerprint | UTC time | key id with an Ed25519 key and returns the signature. The receipt is stored with your case on your device and printed in the packet appendix. The public key and its fingerprint are published on the signing keys page, so anyone can check a receipt without asking us. A receipt shows when a fingerprint was recorded. It makes no claim about admissibility, and none about what happened before the screenshot was taken.

What our servers store

  • Account email and authentication records, if you create an account.
  • Subscription state received from Paddle. We never see your card number.
  • Counters such as exports run and AI reviews used this month.
  • Support messages you send us, and standard request logs with IP and user agent.

Encryption

  • All traffic is HTTPS with TLS 1.2 or better; HSTS is set on the production domain.
  • The database is encrypted at rest by the hosting provider.
  • Passwords are stored as salted hashes by the authentication provider, never in plaintext.

Encrypted case sync

Sync is off by default. When you turn it on, the browser derives a 256-bit key from your passphrase with PBKDF2-SHA256 at 600,000 iterations and a random 16-byte salt, packs the case (images, redactions, labels, signatures, logo) into a single archive, and encrypts it with AES-GCM using a random 12-byte nonce. The case name is encrypted separately. Only the ciphertext, the nonce, the salt, the size and timestamps reach our storage, in a private bucket where row-level policies allow the owning account and nobody else. There is no public access and no server-side key.

A wrong passphrase simply fails to decrypt, with no hint given. We cannot reset it. Limits are 200 MB per case and 2 GB per account. Turning sync off deletes the blobs within 24 hours.

Access control

Every database table has row-level security switched on, with policies scoping rows to the owning account. Administrative views require a role stored in a separate roles table, checked on the server on every request. There is no client-side admin flag.

Subprocessors

  • Hosting, database and authentication: our cloud backend provider.
  • Payments and invoicing: Paddle, as merchant of record.
  • Transactional email: Resend.
  • AI Packet Review: the model gateway used by our backend, with training disabled.

None of them receive your screenshots, with the single exception of the mail provider when you choose to email a packet.

Retention

  • Emailed packet files: deleted after delivery, and in any case within 24 hours.
  • Request logs: 30 days.
  • Account and billing records: for the life of the account, then as required for tax records.
  • Deleting your account removes account-linked rows.

Reporting a vulnerability

Email abe.mainlinesites@gmail.com with "security" in the subject. We aim to acknowledge within two business days. Please give us a reasonable window before publishing, and do not access anyone else's data while testing. We do not currently run a paid bounty.

What we do not claim

We are a small product and we do not hold SOC 2 or ISO 27001. We are not a forensic service, and a hash in the appendix records only that a file is unchanged since export. Read the privacy policy and the terms for the binding version of all this.