Private by default, stored as data and never as a running site, no captured form values, and a DPA for teams.
Principles baked into the product, not bolted on after.
Everything SpecShot documents, from a captured section to a full page design your agent builds, is persisted as structured JSON. It is never rendered or executed as HTML, and never hosted as a running site.
We deliberately skip input values when capturing a section, so passwords, search terms, and other field contents are never collected.
Designs, screenshots, and exports live in private storage scoped to your workspace. Client review and share links are opt-in, per item, and revocable at any time.
Your MCP connection, BYO AI keys, GitHub and Linear tokens, and webhook secrets are encrypted at rest with a dedicated key. They are never stored or displayed in plaintext.
Billing runs entirely through Stripe. We never see or store your card details.
Authentication is handled by Clerk. Data sits behind row-level security so workspaces can only ever access their own records.
SpecShot documents a design and its context to brief your build. It does not clone, copy, or host anyone else's site.
in a design and its full context
out structured data and a build-ready spec
never a running site, captured form values, or a hosted copy