Last updated: August 22, 2026
CapacityLab runs load diagnostics against applications you already operate. To do that it holds provider credentials you connect, the metadata of your applications and the results of every run. This page describes how that data is protected, how to tell us about a weakness, and which third parties are involved.
1. Reporting a vulnerability
Email security@capacitylab.dev. You will get a human reply within three working days, and a fix or a mitigation plan within thirty days for anything confirmed. Please include steps to reproduce and, if you have one, a proof of concept. Encrypted reports are welcome but not required.
The same contact is published machine-readably at capacitylab.dev/.well-known/security.txt and app.capacitylab.dev/.well-known/security.txt (RFC 9116).
There is no bug bounty at this time. We credit reporters in the release notes if they want to be credited.
In scope: capacitylab.dev, app.capacitylab.dev (console and API), the MCP endpoint, the worker runtime and the published container images. Please do not run load or denial-of-service tests against our production (this is a load-testing product — use your own targets), access data of accounts other than your own test account, or use social engineering against the team or our providers.
2. How customer data is protected
- Sign-in to the console is OAuth only (Google, GitHub, Telegram). There are no passwords to leak or to guess.
- Provider credentials you connect (Railway, Vercel, Render) are encrypted at rest with a key held only by the runtime and decrypted only for the duration of a call. They never appear in logs.
- API tokens for the MCP endpoint are shown once and stored only as a SHA-256 digest. They expire after 90 days, can be revoked or rotated at any time, and every request re-checks that the holder is still a member of the account with the role the token was issued under.
- Account isolation: every stored row carries the account it belongs to, and every query is scoped to it. A linter in our build fails on any query that forgets.
- Transport: TLS everywhere, HSTS on the console, the API and this site.
- Action log: every change made through the console, the MCP endpoint or an operator is recorded with who did it, from where and when, and is visible to the account under Settings.
- Abuse budgets: per-address request limits and an authentication-failure cut-off protect the public endpoints.
- Supply chain: production dependencies are audited in CI, container images are scanned for high and critical vulnerabilities before they are published, and a secret scanner blocks commits that carry credentials. Releases are reproducible from immutable registry digests with build provenance.
- Incident handling: what happens when something goes wrong — isolation, rotation, timeline, customer notice — is written down and rehearsed on real events.
3. Subprocessors
Third parties that process customer data on our behalf. Customer data means the provider credentials you connect, the metadata of your applications and topology, diagnostic results and reports, run telemetry, your email address and account identifier.
- Railway — hosts the application services and the PostgreSQL control store (EU). Processes: application and account data, run metadata, service logs.
- Google Cloud — runs the diagnostic worker (Cloud Run Jobs) and stores run artifacts and reports (europe-west3, Frankfurt).
- Cloudflare — DNS, TLS termination, access control for pre-production and observability, this website, and email routing for security@ (global network).
- Trylle (on E2B infrastructure) — source code hosting and CI (US). Contains no customer data.
- Vercel, Render, Railway provider APIs — your own resources at the provider you connected, only after an explicit connection and only within the resources you selected.
- Chatwoot — support chat messages and the sender's email (EU). Loaded only after you press the support button.
- Polar — payments, invoices and tax handling: your email, what you bought and the order identifiers; card details never reach CapacityLab (region: to be confirmed; transfer under DPF/SCC).
- Fibery — our work tracker: a booked call becomes a task with the booker's name, email and answers (region: to be confirmed).
- Tymeslot and Cal.com — call scheduling: name, email and booking answers. Loaded only after you press the booking button (regions: to be confirmed).
Transfers outside the EEA: Cloudflare operates a global network and, where a provider above is established in the United States, the transfer relies on the EU–US Data Privacy Framework where certified and on Standard Contractual Clauses otherwise.
Not used: third-party LLM providers in the processing of customer data, and third-party advertising or analytics trackers in the console. Console telemetry is first-party, self-hosted Grafana Faro with a notice and an off switch under Settings → Privacy.
This list is reviewed with every new integration and at least quarterly. Questions about it go to the same address: security@capacitylab.dev.