Security & Compliance

Last Updated: March 2026

1. Zero Cloud Storage Architecture

Our API endpoint /api/compare operates as a passthrough evaluator. It receives two Base64-encoded images, forwards them to the AI model, returns the result, and destroys all image data. There is no intermediate storage at any point in this pipeline.

• No disk writes: Images are never persisted to Vercel's filesystem, any cloud object storage, or database.
• No log leakage: We explicitly exclude image payloads from all server logs. Only anonymised metadata is logged (request count, status code, credit balance).
• No backups: Because nothing is written, there is nothing to back up and nothing that could appear in a backup breach.
• Baseline images stay local: bhv-snapshots/ lives exclusively in your repository or CI artifact storage. We never read or receive baseline files directly.

2. AI Model & Data Retention Policy

Visual evaluation is performed by Anthropic Claude Vision (claude-opus-4-6) via the Anthropic API.

• No model training on your data: Your screenshots cannot influence future model behaviour.
• Anthropic API only: We do not use any other AI provider for image processing.
• Our Anthropic API key never leaves our infrastructure: Customers authenticate against our backend using Unkey tokens — the master Anthropic API key is never exposed.

3. Authentication & Token Isolation

API access is managed through Unkey, a purpose-built token management platform with per-key credit buckets.

• Per-customer isolation: Each API token maps to an isolated credit bucket. One customer's token cannot consume another's credits.
• Credit-based rate limiting: Tokens automatically reject calls when credits are exhausted — no additional configuration required.
• Token prefix visibility: Tokens are prefixed bhv_.... Only the prefix is logged for debugging — the full token is never written to any log or database.
• Our master Anthropic key stays private: The key used to call Anthropic's API resides exclusively in our Vercel environment variables and is never transmitted to clients.

4. GDPR & Enterprise Compliance

BugHunters Vision is designed to comply with GDPR and the data minimisation requirements common in banking, healthcare, and enterprise environments.

• No UI screenshot storage: The most sensitive data — your application's UI — is never retained. GDPR Article 25 data-minimisation is met by architecture, not policy.
• Minimal operational data: We store only your email address (for billing and token delivery) and anonymised API usage metadata (call count, credit balance, plan).
• Data residency: Our API infrastructure runs on Vercel (AWS us-east-1 edge network). EU-region isolation is available on request for Paranoia Tier customers.
• Right to erasure: Contact info@bughunters.dev to have your email and Unkey token permanently deleted.
• DPA available: A Data Processing Agreement (DPA) is available for enterprise customers on request. Required for banking and healthcare procurement.

5. Responsible Disclosure

If you discover a security vulnerability in BugHunters Vision, please report it responsibly to security@bughunters.dev. We acknowledge reports within 48 hours and aim to patch critical findings within 7 days. We do not pursue legal action against good-faith researchers.

6. Contact & Custom DPA

For InfoSec review materials, custom DPA, or procurement questionnaires, contact us at info@bughunters.dev. For enterprise Paranoia Tier enquiries (on-premise, VPC, BYOC), use the Schedule PoC link on our pricing page.