Security and privacy

Your work stays yours, and stays private.

Private by default, stored as data and never as a running site, no captured form values, and a DPA for teams.

Private by defaultStored as dataNo form valuesDPA available
01 / Pillars

Security by design

Principles baked into the product, not bolted on after.

Designs and captures stored as data, not code

Everything SpecShot documents, from a captured section to a full page design your agent builds, is persisted as structured JSON. It is never rendered or executed as HTML, and never hosted as a running site.

No form values captured

We deliberately skip input values when capturing a section, so passwords, search terms, and other field contents are never collected.

Private by default

Designs, screenshots, and exports live in private storage scoped to your workspace. Client review and share links are opt-in, per item, and revocable at any time.

Encrypted integration secrets

Your MCP connection, BYO AI keys, GitHub and Linear tokens, and webhook secrets are encrypted at rest with a dedicated key. They are never stored or displayed in plaintext.

Payments handled by Stripe

Billing runs entirely through Stripe. We never see or store your card details.

Managed, isolated infrastructure

Authentication is handled by Clerk. Data sits behind row-level security so workspaces can only ever access their own records.

02 / For teams

Built for organizations

  • Workspace-scoped access. Members only see their own workspace data.
  • Role-based team membership across six roles, from owner down to read-only viewer.
  • Client review runs in a scoped portal. Reviewers see only the design you share.
  • Data Processing Agreement (DPA) available for teams that need one.
  • Export or delete your captures, designs, and prompts at any time.
  • Granular Chrome extension permissions. Capture only runs when you click.
03 / Positioning

Documentation, never duplication

SpecShot documents a design and its context to brief your build. It does not clone, copy, or host anyone else's site.

Positioning

in a design and its full context

out structured data and a build-ready spec

never a running site, captured form values, or a hosted copy