Last updated 2026-09-09 · htmlimport · Switzerland
How htmlimport handles security, and how to report a problem.
Email hello@htmlimport.com with "security" in the subject. Include what you found, how to reproduce it and, if relevant, which account or URL was involved. You will get an acknowledgement within 3 business days and updates as we work on it. We ask that you give us a reasonable time to fix or mitigate the issue before disclosing it publicly, that you do not access or modify other people's data beyond what is needed to demonstrate the problem, and that you do not run automated scanning against the capture service (it is rate-limited and you will simply be blocked). We are happy to credit you when the issue is resolved, if you want that.
Account email addresses; license keys stored only as SHA-256 hashes; per-import usage records (URL, widths, timestamp, duration, status); Stripe customer and subscription identifiers. Captured page content and any image the plugin sends for the pixel diff exist on the server only for the minutes needed to process them and are then deleted. The service never receives card numbers (Stripe handles payment) and never stores content from your Figma files.
All traffic is over HTTPS. Secrets live in the hosting environment, never in the code. Sign-in links are signed, single-purpose and expire after 30 minutes. The capture browser refuses private-network and non-public addresses, including redirects into them, and each capture runs in a fresh browser context. Requests are rate-limited per key and per address. Dependencies are kept current and the code base is small enough to review in full.
Railway (hosting and database), Stripe (payments), Resend (transactional email), Cloudflare (DNS and email routing). Each publishes its own security and compliance information. htmlimport itself is not independently certified (no SOC 2 / ISO 27001 report).
Questions: hello@htmlimport.com.