Peutly
Security

Security at Peutly

Last updated 5 October 2026. A plain overview for security reviews first, then our responsible-disclosure policy. Found something? Jump to how to report it.

Trust overview

The short version of what a security questionnaire usually asks. Where something is not in place yet, we say so.

Hosting and data residency
The application and file storage run on AWS in the EU (Frankfurt, eu-central-1). The database is MongoDB Atlas, also on AWS Frankfurt. Published demo files are cached at CDN edge locations worldwide. A few services sit outside the EU, such as sign-in through an identity provider and the optional AI features; each is listed on the sub-processor page. We do not offer a choice of region.
Encryption
In transit: HTTPS only, with TLS 1.2 or higher; plain HTTP is redirected. At rest: file storage is encrypted with AES-256 and the managed database is encrypted by the provider. Integration secrets are stored encrypted with AES-256-GCM, and demo passwords only as a salted bcrypt hash. Storage buckets are private, reachable only through our CDN, behind a web application firewall.
What a capture stores
The Chrome extension records the real page structure (HTML and CSS) of what you capture, your clicks and scrolling, and the images on the page. Each click becomes a step. What you capture is what your viewers' browsers load, so record with demo data where you can.
Blurring and hiding
Blur, hide and remove are applied when the demo plays: the element is masked on screen, but the original content stays in the stored capture and is sent to the viewer's browser along with the rest of the page. Treat blur as a visual mask, not as redaction. The reliable way to keep sensitive data out of a demo is to not capture it: record with demo data.
Password fields
Password inputs are masked automatically at capture time, so the typed value is never recorded. Other inputs, including email and text fields, are recorded as typed.
DPA and sub-processors
Our Data Processing Agreement applies automatically when you use Peutly; there is nothing to sign. Every company that processes data for us, what it receives and where, is on the sub-processor page.
Sign-in and SSO
Sign-in is by email magic link, Google or Microsoft. There are no Peutly passwords to steal. On Pro and Enterprise, admins can turn off email sign-in and require Google or Microsoft. SAML SSO and SCIM provisioning are not available today.
Certifications
The technical and organisational measures we commit to are listed in section 7 of the DPA.
Deletion on request or cancellation
When your subscription ends, or when you ask us at privacy@peutly.com, we delete your recordings, assets, viewer sessions, engagement events and leads within 30 days and confirm it in writing. Database backups roll over on the provider's schedule. Retention periods are in the Privacy Policy.

The full list of measures we commit to contractually is in section 7 of our Data Processing Agreement. More detail is available on request at security@peutly.com.

Responsible disclosure

Our commitment

Security is a core part of how we build Peutly. We know we won't catch everything, so we welcome reports from security researchers and anyone who spots a problem. If you report a genuine vulnerability in good faith, we'll work with you to understand it, fix it quickly, and keep you in the loop. This page explains how.

How to report

Email the details to security@peutly.com. A useful report usually includes:

  • A clear description of the issue and its potential impact.
  • Step-by-step instructions or a proof of concept to reproduce it.
  • The affected URL, endpoint, or component, and any relevant account or request details.
  • How you'd like to be credited, if the report is valid and you want acknowledgement.

If your report contains sensitive data, let us know and we'll arrange an encrypted channel. Please send reports in English or Dutch where you can.

What we promise in return

  • We'll acknowledge your report within 3 business days.
  • We'll give you an initial assessment, and a rough timeline for a fix, within 10 business days.
  • We'll keep you updated on progress and let you know when the issue is resolved.
  • We'll credit you in our acknowledgements below if you'd like, once the issue is fixed.

Safe harbour

If you make a good-faith effort to follow this policy, we will consider your research authorised, we will not pursue or support legal action against you for it, and we will work with you if a third party tries to. This authorisation covers only your own account or accounts you have explicit permission to test. It does not extend to other customers' data. If in doubt about whether an action is allowed, ask us first at security@peutly.com.

Ground rules

  • Give us a reasonable time to investigate and fix an issue before disclosing it publicly, and please coordinate any disclosure with us.
  • Only interact with accounts you own or have permission to test. Don't access, modify or delete other people's data.
  • Use the minimum access needed to demonstrate the issue. Don't pivot deeper or exfiltrate data once you've proven the point.
  • Don't run attacks that degrade the Service for others, such as denial of service, spam, or high-volume automated scanning.
  • Don't use social engineering, phishing, or physical attacks against our staff, users, or offices.
  • Keep anything you learn about our systems or customers confidential.

In scope

Vulnerabilities in the systems we operate, for example:

  • The Peutly application and dashboard.
  • Our public website and hosted demo pages.
  • The backend APIs behind the app, and our outbound webhook delivery.

Typical issues we care about include authentication and authorisation flaws, injection, access-control and data-exposure bugs, server-side request forgery, remote code execution, and account-takeover paths.

Out of scope

These generally don't qualify on their own, unless you can chain them into a real, demonstrable impact:

  • Reports from automated scanners with no proven exploitability.
  • Missing security headers, cookie flags, or best-practice suggestions with no concrete impact.
  • Clickjacking on pages with no sensitive actions, and self-XSS.
  • Rate-limiting, brute-force, or denial-of-service concerns.
  • Issues that require a rooted/jailbroken device, physical access, or a compromised network.
  • Social engineering, phishing, or spam.
  • Vulnerabilities in third-party services we don't control (please report those to the relevant vendor).

Rewards

Peutly doesn't run a paid bug-bounty programme at this time, but we deeply appreciate every valid report and are glad to offer public credit and, where appropriate, Peutly swag or account credit as a thank-you.

Acknowledgements

Once a reported issue is resolved, we'll name the researcher here if they want the credit. The list is empty so far. Want to be the first on it? Send us a great report.

Reach the security team any time at security@peutly.com. For privacy questions, see our Privacy Policy.