Security & Compliance

Security & Compliance:
How ui.rip Handles Data

Transparent documentation of our security practices, data handling, and compliance posture.

Request our security questionnaire →

Data Handling

Exactly what our capture pipeline processes — and what it doesn't touch.

What we capture

  • • DOM snapshots — the rendered HTML structure of the target page
  • • Computed stylesheets — CSS rules applied to visible elements
  • • Static assets — images, fonts, and icons referenced by the page
  • • Layout metadata — viewport dimensions, scroll positions, bounding boxes

What we don't capture

  • • Credentials — no passwords, tokens, or authentication data
  • • Cookies — browser cookies are never read or stored
  • • Local storage — no access to localStorage, sessionStorage, or IndexedDB
  • • User data — no personal information, form inputs, or user-generated content

Data Retention

  • • Captured snapshots are retained for 30 days by default
  • • Generated output (code) is available until explicitly deleted
  • • Enterprise customers can request immediate deletion at any time
  • • All data is permanently purged within 48 hours of a deletion request

Processing Pipeline

1 Capture — DOM snapshot taken via headless browser
2 Analysis — Structure parsed, components identified
3 Generation — Clean React/Next.js code emitted
4 Delivery — Output packaged and made available to you

Infrastructure & Security Controls

Technical details about how we protect your data at every layer.

Hosting & Region

  • Cloudflare Workers for edge compute
  • Processing nodes in US-East and EU-West
  • CDN-distributed static assets globally
  • No data leaves specified processing regions

Encryption

  • In transit: TLS 1.3 enforced on all connections
  • At rest: AES-256 encryption for stored data
  • API keys hashed with bcrypt
  • No plaintext secrets in logs or storage

Access Controls

  • Role-based access for internal systems
  • MFA required for all team members
  • Principle of least privilege enforced
  • Quarterly access reviews

Incident Response

  • Documented incident response plan
  • Affected customers notified within 72 hours
  • Post-incident review and public disclosure
  • security@ui.rip for responsible disclosure

Compliance

Our current certifications, compliance roadmap, and data protection commitments.

In Progress

SOC 2 Type II

Audit in progress. Estimated completion Q3 2026. We can share our current security controls documentation on request.

Active

GDPR

ui.rip processes publicly available website data. We do not process personal data of end users. EU processing region available.

Available

Data Processing Agreement

Standard DPA available for enterprise customers. Custom DPA negotiation available for large-volume accounts.

A note on honesty: We're a growing company and we're transparent about where we are. If a certification isn't achieved yet, we'll tell you the timeline rather than imply compliance. If you have specific compliance requirements, reach out and we'll tell you exactly where we stand.

Security FAQ

Common questions from enterprise security teams.

What data does ui.rip capture from target websites? +
We capture the rendered DOM structure, computed CSS styles, and referenced static assets (images, fonts, icons). This is equivalent to what you see when you open browser DevTools — publicly visible page structure only. We do not execute JavaScript on your behalf or access any authenticated content.
Does ui.rip store the captured data? For how long? +
Captured snapshots are retained for 30 days by default to enable re-processing if needed. Generated code output is available until you delete it. Enterprise customers can request immediate deletion at any time, and all data is permanently purged within 48 hours of a deletion request.
Is ui.rip SOC 2 compliant? +
SOC 2 Type II audit is currently in progress with an estimated completion of Q3 2026. We can share our current security controls documentation, policies, and procedures upon request to help your security team evaluate us while the formal audit is underway.
Can we get a Data Processing Agreement (DPA)? +
Yes. A standard DPA is available for all enterprise customers. For large-volume accounts, we offer custom DPA negotiation. Contact our team at security@ui.rip to request one.
Where is ui.rip data processed and stored? +
Processing runs on Cloudflare Workers with nodes in US-East and EU-West. Data does not leave the specified processing region. Enterprise customers can select their preferred processing region. All data is encrypted in transit (TLS 1.3) and at rest (AES-256).
How do you handle security incidents? +
We maintain a documented incident response plan. In the event of a security incident, affected customers are notified within 72 hours. We conduct post-incident reviews and provide public disclosure. For responsible disclosure, contact security@ui.rip.

Have security questions?

Talk to our security team. We'll respond within 1 business day.

Or email us directly at security@ui.rip