What the service processes
Your client collects the protection scripts and browser context, submits the intended request to Rayon API, and receives Shape telemetry. Your client then sends the application request to the target. The generation service does not fetch target pages or make that subsequent target request.
Generation inputs can include script text, contextual URLs, a browser profile, canvas data, JavaScript-visible cookies and the intended request body. These inputs can contain personal information and secrets even when a capture is described as sanitized. HTTPS protects transport; it does not remove sensitive content from a payload.
During evaluation, use test accounts and minimize captured material. Passwords and payment-card data are prohibited. Before sending other sensitive production data, agree the processing purpose, permitted inputs, contractual terms and location requirements with us. Do not send full HAR files, passwords, session cookies or API keys through public issues or community chat. Contact support first to arrange an appropriate evidence exchange.
Authentication and access
Customer generation requests require a bearer key associated with an active account, current policy acceptance and approved source and endpoint domains. API-key secrets are shown once at creation and stored as hashes in the customer database. Keys can be revoked through the dashboard; keep them server-side and out of target requests and client logs.
Dashboard sessions use protected cookies. State-changing dashboard operations check the request origin and CSRF token. Administrative actions and diagnostic access are restricted to authorized personnel. Account controls and domain approval are service access controls; they do not grant permission to access a third party's systems or personal data.
Execution and infrastructure
Customer-supplied JavaScript executes in restricted private workers with operating-system confinement, resource limits and restricted network and filesystem access. Reviewed native generation paths handle approved material separately. Browser emulation alone is not treated as the security boundary.
The standard hosted service uses shared infrastructure with account-scoped access controls. A dedicated enterprise deployment is a separately reviewed arrangement; a standard account or trial does not automatically provision a private server. Dedicated scope and operator access are recorded in the customer agreement.
Encryption and operational access
Public API and dashboard connections use HTTPS. Failure diagnostic captures are encrypted, and encrypted off-server backup tooling is part of our operational setup. Encryption coverage, key custody and recovery arrangements for an enterprise deployment must be documented for that deployment; this overview does not claim universal encryption of every storage layer.
Personnel access is limited to operational and support purposes. Failure-capture access has a bounded encrypted action history; this is not a complete attributable privileged-access audit trail. Our deployment procedures include bounded services, release verification, backups and recovery checks. Customer-specific availability, recovery and incident-notification commitments require an agreement; there is no standard contractual response-time or uptime SLA.
Retention and diagnostics
Different records have different purposes and lifecycles:
- Material references: five minutes of logical validity. Eviction or restart can remove material earlier, and physical cleanup can occur later. Logical expiry is not a guarantee that every operational copy disappears at that instant.
- Derived processing material: learned definitions can retain supported profiles/canvas and source, request or cookie constraints. The configured encrypted store has a 30-day logical retention limit and definitions can be restored after worker restarts. Earlier expiry, eviction or revocation is possible; physical cleanup can follow logical expiry. Expiring a five-minute source reference does not delete retained derived material.
- Failure diagnostic captures: relevant failures after generation executes can automatically capture submitted or resolved scripts, effective profile and canvas, URLs, request details and exception evidence. Captures are encrypted, expire after 72 hours, may be deleted sooner and are excluded from ordinary backups. Storage limits can leave them partial or unavailable.
- Usage records: detailed generation history is retained for 30 days and hourly aggregates for 365 days. The usage database does not retain full target query strings, generated telemetry values, document cookies or profile contents. This statement does not describe the separate failure-diagnostic store or all infrastructure logs.
- Account, billing and agreement records: retained according to their operational purpose and applicable obligations, as explained in the Privacy Policy. Account closure does not automatically erase every record or backup.
Failure capture excludes or redacts detected credentials, session values and sensitive body fields. Arbitrary supplied material cannot be guaranteed secret-free. Captures are used for diagnosis by authorized engineers, not to replay target requests or for marketing. Authentication, domain-access, credit, ordinary request-limit and schema rejections do not trigger these captures. Data minimization and an agreed processing arrangement remain necessary.
Service providers and locations
The standard service uses the providers described in our Privacy Policy:
- Hetzner: API infrastructure, private workers and account/usage storage.
- Vercel: website, documentation, dashboard and request proxy services. An API intermediary is part of the data path even when the compute server is in a particular country.
- Discord: account authentication, community and support communications, including optional membership verification for a trial.
- Stripe: hosted payments, invoicing and subscription services.
- Doppler: configuration and secret management; customer generation material is not intentionally stored as configuration.
- Email and infrastructure services: support delivery and operational services where necessary. The relevant service entities and locations must be confirmed during enterprise review.
This is a service-provider overview, not a customer-specific approved subprocessor schedule. The standard service is not represented as US-only or restricted to another single country. The Privacy Policy describes processing across the UK, EEA, United States and other provider locations. Server placement alone does not establish data residency: intermediaries, diagnostic storage, logs, backups and remote support access must also be assessed.
Sensitive-data and enterprise review
Before a sensitive production integration, agree a data-flow inventory, the minimum necessary inputs, end-user authority, data-processing terms, applicable providers and locations, diagnostic handling, operator access and deletion/return arrangements. Document any mandatory country boundary and verify it before activation. Dedicated hosting does not by itself establish regulatory compliance or absolute security.
Rayon API generates request telemetry. The customer remains responsible for permitted target access, end-user consent or other applicable authority, authentication and MFA, session handling and the lawfulness of downstream account changes. See Enterprise hosting for the deployment review.
Assurance and reporting
We do not currently claim SOC 2 attestation or ISO 27001 certification for Rayon API. A provider's certification does not certify our service. This page describes controls and boundaries; it is not an independent audit report or a replacement for the Terms, Privacy Policy or a signed enterprise agreement.
Report a suspected vulnerability or data exposure privately to support@rayonapi.com. Share affected versions, request identifiers and a minimal description first; do not attach credentials or sensitive customer material until an appropriate exchange has been arranged. Enterprise incident contacts and notification obligations should be recorded in the agreement.