Is GrabzIt GDPR compliant?

Yes, we are fully compliant with the General Data Protection Regulation (GDPR) and are registered with the UK Information Commissioner's Office (Ref: ZA562571).

Where does GrabzIt store my data?

We separate data storage to optimize for compliance. Web Scraper results and metadata are stored exclusively in the UK. Screenshot Tool archives are stored in the UK (Wasabi), with automatic cross-region replication for redundancy. Archive metadata is stored in the UK. API data is transient.

How are archived capture links secured?

Links generated to view archived Screenshot Tool captures use unique, cryptographically secure tokens that automatically expire after 30 minutes to prevent unauthorized sharing.

Do you provide a Data Processing Agreement (DPA)?

Yes, for enterprise customers acting as Data Controllers, we provide a standard DPA compliant with UK and EU GDPR (Article 28). Please contact support to arrange a signed copy.

Does GrabzIt have a Service Level Agreement (SLA)?

Yes, we offer an Enterprise SLA guaranteeing 99.99% uptime (less than 4.38 minutes of downtime per month), hosted on ISO-27001 certified infrastructure by IONOS.

Can I delete my Screenshot Tool data from GrabzIt servers?

Yes. We provide a 'Kill Switch' where deleting a scheduled task immediately and permanently removes all associated archives. We also offer a 'Delete on Completion' feature for transient processing.

Is GrabzIt Cyber Essentials certified?

Yes, GrabzIt is officially certified under the UK Government’s Cyber Essentials scheme, demonstrating our defenses against common cyber threats.

GrabzIt Trust & Security Center

Transparency is at the core of our platform. We combine enterprise-grade security with complete data control.

Security Certifications & Compliance

We are committed to the highest standards of cyber security and data protection.

Cyber Essentials Certified: We are officially certified under the UK Government’s Cyber Essentials scheme, demonstrating our defences against common cyber threats.
GDPR Compliant: We are fully compliant with the General Data Protection Regulation and registered with the UK Information Commissioner's Office (Ref: ZA562571).
PCI Standards: We do not store credit card details. All payments are processed by PCI-compliant providers (Stripe and PayPal).
Data Processing Agreement (DPA): We provide a standard DPA compliant with UK and EU GDPR (Article 28) for all customers. Please contact support to arrange a signed copy.

Reliability & Infrastructure

Your critical business processes rely on us, so we have built a redundant, scalable infrastructure.

Enterprise SLA: We offer a Service Level Agreement for Enterprise customers, guaranteeing 99.99% uptime (less than 4.38 minutes of downtime per month).
Trusted Hosting: Our infrastructure is hosted by IONOS, a leading provider known for its ISO-27001 certified data centers and commitment to sustainability.
Scalability: Our architecture uses multiple redundant systems at all layers to ensure fast, efficient responses regardless of load.

Data Location & Sovereignty

We separate data storage to optimize for both performance and local compliance.

Service	Data Location	Details
Core Platform	UK	Stores all user accounts, billing information, task configurations, and metadata for all services.
API	Transient	Data is processed in real-time. Temporary caching is available in the US or UK, depending on your selected configuration.
Screenshot Tool	UK	Permanent archives are stored in a secure Wasabi bucket located in the UK, with automatic cross-region replication for redundancy.
Web Monitor	UK	All web monitor results and metadata are processed and stored exclusively in the United Kingdom.
Web Scraper	UK	All scrape results and metadata are processed and stored exclusively in the United Kingdom.

To ensure compliance, all permanent archives are stored securely within the United Kingdom. For capture operations, our system utilizes a global network (including US and UK servers) by default to minimize latency, with temporary caching occurring at the region of capture. However, you retain full control: you can configure GrabzIt to use exclusively UK servers, ensuring that neither processing nor data ever leaves UK jurisdiction.

Data Retention & Control

You are never locked in. We provide the tools for you to manage your data lifecycle.

Screenshot Tool Controls:
- The "Kill Switch": If you delete a scheduled task, all associated archives and cached data is immediately and permanently deleted from our servers.
- Delete on Completion: You can configure tasks to delete results immediately after they are delivered to your webhook, email or third party storage.
Retention Timelines:
- API: Cache time is customizable from 0 minutes (instant delete) up to 12 hours.
- Screenshot Tool: Archives are available for up to 5 years for Enterprise users, but can be deleted manually at any time.
- Web Monitor: The metadata required for web monitoring is kept until the monitor is deleted by the user.
- Web Scraper: Results are automatically deleted from the server after 48 hours, but can be deleted manually at any time.

Advanced Security Features

Encryption at Rest: You can provide your own encryption keys to encrypt captures before they are stored. We do not store your keys, meaning only you can decrypt the files.
Secure Archive Access: Links generated to view archived Screenshot Tool captures use unique tokens and expire automatically after 30 minutes to prevent unauthorized sharing.
Secure Transfers: We support SSL for all data transmission and offer secure automatic transfers to FTP, Amazon S3 and Dropbox and more.
Virus Free: We monitor our systems to ensure they are free of viruses and harmful components.
Least Privilege Access: Our support and engineering teams cannot access your capture data without your explicit permission for troubleshooting.

Responsible Disclosure: Found a security vulnerability? Please contact us.