Security and privacy — Archivepanel

Nothing is public

Files are shown only to signed-in members of your workspace. A share link opens one snapshot, and it expires.

Saved pages can't act

Scripts are removed, and an opened archive can't reach the network or read your session.

Strong sign-in

An emailed code, an authenticator app or a passkey on every account. Never a password alone.

An archived page cannot act on you.

The pages you save come from the open web, so we treat them as untrusted when you open them as well as when we fetch them.

Before anything is fetched the address is checked, and every redirect after it. Once stored, a page is shown only to signed-in members of your workspace.

Every captureApplied

Private, loopback and internal addresses are refused, and so is any redirect to one
Scripts are removed from the saved page
The file carries a policy that stops it reaching the network
It opens on its own origin, so it cannot read a cookie from the dashboard
Forms in an archived page do not submit

Built so that a leak is not a breach.

Sensitive values are stored in a form that is useless to anyone who copies them. Deleting is deliberate: it asks for your password again, and removes every stored file and the timestamp that belongs to the snapshot.

What we storeAnd what we do not

PasswordsHashed with argon2id and a unique salt. Never written down.
SessionsOnly a digest of the token, so a database copy holds no usable session
Emailed and recovery codesOnly digests
Authenticator secretsEncrypted at rest with a server key

What to tell the people who ask

IT and information security

Every account has two-step sign-in, and passkeys are bound to our domain so a look-alike site cannot use them.

Compliance

Captured pages are private by default, and the activity log records captures, schedule changes, sign-ins and team changes.

Counsel

Only a fingerprint leaves for timestamping, never the page, its address or your account.

Questions

Can the capture service be used to reach private networks?

No. Addresses that lead to loopback, private, link-local, carrier-grade NAT or unique-local space are refused, and every redirect is checked again, as is every address a sitemap names. Captures run separately from your request, in a fixed pool with a memory limit.

Is it safe to open a captured page?

Yes. Scripts are removed when the page is saved, and archives are shown on an isolated origin with scripts and forms refused, so a captured page cannot read your session or act in your account. The saved file also carries its own rule against network access.

How are passwords and sessions protected?

Passwords are hashed with argon2id at 64 MB, each with its own salt.
Sessions are stored only as digests, so a copy of the database gives no usable session.
Authenticator secrets are encrypted at rest.
Passkeys are bound to our domain, so a look-alike site cannot use them.
Sign-in and registration are protected by a proof-of-work check, and unknown addresses take as long as real ones.

What leaves Archivepanel?

For each capture, only its SHA-256 fingerprint is sent to DigiCert for the timestamp. Your pages, their addresses and your account details are not shared. What we store and for how long is in the privacy policy.

Can I see and end my sessions?

Yes. Settings lists every signed-in session, and you can end any of them without changing anything else.

Can I delete everything?

Yes, from Settings. You can erase every snapshot and schedule and keep the account, or close the account entirely. Both need your password, and deleting a single snapshot needs it too.

Private from the first capture.