Security & trust
WebUplink gives your agent a real, isolated browser — ephemeral by design. Every session runs in a sandboxed environment that is automatically destroyed. No page data, no cookies, no interaction state is ever retained after a session ends.
Session data handling
All session data is ephemeral. Browser state, cookies, and any data entered during tool execution exist only in the transient session and are destroyed when the session ends. Tool parameters containing sensitive values are redacted from server logs before storage.
Session isolation
Each API request runs in an isolated, sandboxed session; the browser engine underneath is plumbing we manage. Sessions share no state — no cookies, localStorage, or credentials leak between requests or tenants.
- Automatic destruction on idle (2 minutes) or max duration (15 minutes)
- No session reuse across tenants
- Each session is fully sandboxed and isolated
Infrastructure security
- TLS 1.2+ encryption for all data in transit
- Edge WAF for DDoS protection and request filtering
- Global External Application Load Balancer with managed SSL certificates
- Internal service-to-service communication via Cloud Run
- Encrypted HttpOnly session cookies (SameSite=Lax, Secure)
Data security
- API keys are SHA-256 hashed at rest — raw keys are never stored
- Cloud-provider IAM for all infrastructure access control
- No PII stored from browsed web pages — content is transient only
- Server-side tenant isolation with per-request authorization
- A PCI-DSS Level 1 payment processor handles all payment data — WebUplink never sees card numbers
Access controls
- SSRF protection: DNS resolution and IP validation before page access
- IP-literal blocking (prevents 169.254.x.x, 10.x.x.x, etc.)
- Domain denylist for banking, streaming, and ticketing platforms — all plans
- Login automation (third-party auth/SSO domains) is a verification-gated capability, not a plan feature: it requires a card on file plus Acceptable Use Policy attestation, on every plan
- Disposable email provider blocking at signup
Abuse prevention
- Distributed rate limiting via a managed Redis layer
- Per-tenant concurrency admission control
- Strongly-consistent quota enforcement for unpaid plans (fail-closed)
- Login-automation abuse telemetry with automatic capability suspension
- Spend caps on by default for paid plans (customer-adjustable, never off)
- Trust-based billing thresholds that scale with payment history
Compliance
- Privacy Policy — what we collect and how we handle it
- Terms of Service — acceptable use, credential handling, and enforcement
- Data Processing Agreement — Common Paper DPA v1.1 with EU SCCs, available on request
- SOC 2 Type II — compliance program planned
Responsible disclosure
If you discover a security vulnerability in WebUplink, please report it to security@webuplink.ai. We take all reports seriously and will respond within 48 hours. Please do not publicly disclose the vulnerability until we have had a chance to address it.