Last updated: August 22, 2026
CapacityLab runs load diagnostics against applications you already operate. To do that it holds provider credentials you connect, the metadata of your applications and the results of every run. This page describes how that data is protected, how to tell us about a weakness, and which third parties are involved.
1. Reporting a vulnerability
Email security@capacitylab.dev. You will get a human reply within three working days, and a fix or a mitigation plan within thirty days for anything confirmed. Please include steps to reproduce and, if you have one, a proof of concept. Encrypted reports are welcome but not required.
The same contact is published machine-readably at capacitylab.dev/.well-known/security.txt and app.capacitylab.dev/.well-known/security.txt (RFC 9116).
There is no bug bounty at this time. We credit reporters in the release notes if they want to be credited.
In scope: capacitylab.dev, app.capacitylab.dev (console and API), the MCP endpoint, the worker runtime and the published container images. Please do not run load or denial-of-service tests against our production (this is a load-testing product — use your own targets), access data of accounts other than your own test account, or use social engineering against the team or our providers.
2. How customer data is protected
are no passwords to leak or guess, and current organization membership is re-checked for protected requests.
- Sign-in is owned by Clerk through Google, GitHub or organization SSO. There
- Provider credentials you connect (a Vercel team) are encrypted at rest with a key held only by the runtime and decrypted only for the duration of a call. They never appear in logs.
- MCP authorization uses the product's OAuth 2.1 authorization server instead of separate API tokens. Access tokens are short-lived and DPoP-bound, refresh credentials are revocable, and every MCP request re-checks current organization membership, role and Project scope.
- Account isolation: every stored row carries the account it belongs to, and every query is scoped to it. A linter in our build fails on any query that forgets.
- Transport: TLS everywhere, HSTS on the console, the API and this site.
- Action log: every change made through the console, the MCP endpoint or an operator is recorded with who did it, from where and when, and is visible to the account under Settings.
- Abuse budgets: per-address request limits and an authentication-failure cut-off protect the public endpoints.
- Supply chain: production dependencies are audited in CI, container images are scanned for high and critical vulnerabilities before they are published, and a secret scanner blocks commits that carry credentials. Releases are reproducible from immutable registry digests with build provenance.
- Incident handling: what happens when something goes wrong — isolation, rotation, timeline, customer notice — is written down and rehearsed on real events.
3. Subprocessors
Third parties that process customer data on our behalf. Customer data means the provider credentials you connect, the metadata of your applications and topology, diagnostic results and reports, run telemetry, your email address and account identifier.
- Railway — hosts the application services and PostgreSQL control store. Processes application and account data, Run metadata and service logs.
- Fly.io — managed ephemeral worker execution, with per-Run ownership and scoped capabilities.
- Tigris — private artifacts, reports and runtime manifests.
- Google OAuth / Google Artifact Registry — retained sign-in and canonical software-image dependencies. Fly Registry mirrors the same worker runtime. Google Cloud Run and Google Cloud Storage do not execute or store current diagnostic Runs.
- Cloudflare — DNS, TLS termination, access control for pre-production and observability, this website, and email routing for security@ (global network).
- Trylle (on E2B infrastructure) — source code hosting and CI (US). Contains no customer data.
- Vercel API — your own Vercel team, only after you explicitly connect it and only within the Preview you selected.
- Chatwoot — support chat messages and the sender's email (EU). Loaded only after you press the support button.
- Polar — payments, invoices and tax handling: your email, what you bought and the order identifiers; card details never reach CapacityLab (region: to be confirmed; transfer under DPF/SCC).
- Tymeslot and Cal.com — call scheduling: name, email and booking answers. Loaded only after you press the booking button (regions: to be confirmed).
Processing regions and international-transfer safeguards depend on the applicable service and provider agreements. This source-backed technical map is not an EU-only or Frankfurt-only residency certification. Request the current applicable locations and safeguards at security@capacitylab.dev; a general provider certification alone does not establish a covered transfer.
Not used: third-party LLM providers in the processing of customer data, and third-party advertising or analytics trackers in the console. Console telemetry is first-party, self-hosted Grafana Faro with a notice and an off switch under Settings → Privacy.
This list is reviewed with every new integration and at least quarterly. Questions about it go to the same address: security@capacitylab.dev.