Security at Datafuel

Datafuel builds and operates its own proxy network, scraping APIs and SDK. Nothing is white-labelled, so there is no third-party layer we cannot inspect, patch or switch off. Security work follows three rules: least privilege by default, encryption everywhere, and evidence over promises.

• Infrastructure ownership: gateways, routing and the residential SDK are developed and operated in-house.
• Defence in depth: network segmentation, hardened hosts, per-service credentials and continuous monitoring.
• Independent verification: external penetration tests and the certification programme described below.

• All customer-facing endpoints (dashboard, API, gateway control plane) require TLS 1.2 or higher; TLS 1.3 is preferred and weak cipher suites are disabled.
• Customer data at rest (account records, API keys, usage logs) is encrypted with AES-256; keys are managed in a dedicated KMS with automatic rotation.
• API keys are stored hashed. A key is shown once at creation and can be rotated or revoked from the dashboard at any time.
• Proxy traffic is relayed, not stored. Request and response bodies are not retained after the request completes; see the Privacy policy for the metadata we keep.

• Production access is limited to named engineers, granted per role and reviewed quarterly.
• Single sign-on with hardware-backed MFA is mandatory for every internal system.
• Administrative actions on production are logged to an append-only audit trail.
• Customer accounts support MFA, per-key IP allow-lists and sub-users with scoped permissions.

• Gateways run in EU data centres with redundant upstreams; the control plane is separated from the data plane.
• Hosts are built from hardened images, patched on a fixed cadence and rebuilt rather than modified in place.
• Rate limiting, anomaly detection and automatic IP quarantine protect both the network and the targets our customers reach.
• Residential exits join only through the Datafuel SDK after explicit device-owner consent; the SDK cannot read, store or alter customer traffic.

Infrastructure and application logs are centralised and monitored around the clock. Alerts page an on-call engineer, not a ticket queue.

• Documented incident-response plan with severity levels, owners and communication templates.
• Customers are notified of incidents affecting their data without undue delay and, where GDPR applies, within 72 hours of confirmation.
• Post-incident reviews are written for every severity-1 and severity-2 event and shared with affected customers on request.
• Live availability is published at status.datafuel.ai.

• Automated dependency and container scanning on every build; critical findings block deployment.
• Annual penetration test by an independent firm; the executive summary is available to customers under NDA.
• Internal bug-bounty style review before major releases of the API and dashboard.

If you believe you have found a vulnerability in a Datafuel system, email security@datafuel.ai with steps to reproduce. We acknowledge reports within two business days, keep you informed while we fix the issue and credit researchers who wish to be named. Please do not access customer data, degrade the service or run automated scanners against production.

Certifications: SOC 2 Type II and ISO/IEC 27001 audits are in progress. Reports will be available under NDA once issued; see Compliance & certifications for the current status.