Hosted demo privacy

What a scan may store

Depending on the scan type and enabled scanners, StageFlow may temporarily store:

• Page URLs, titles, DOM snippets, response metadata, and scanner findings.
• Full-page screenshots and per-finding image evidence.
• Generated HTML and JSON reports.
• Scanner logs and timing/error information.
• Playwright storage state or form-login values supplied for an authenticated scan.

Do not submit confidential builds, private customer data, production credentials, or sensitive authenticated targets to the hosted demo.

Retention and access

A finished scan's job record and files are deleted 24 hours after it completes. The job record holds the submitted URL, scanner configuration, state, and timing. Browser-local project reports and baseline files stay on your device until you remove them.

Report files and screenshots are not backed up. The database is backed up nightly and daily backups are kept for 14 days, with all backups younger than 48 hours preserved. A job record can outlive the 24 hours in a backup.

A job ID is an unguessable bearer-style reference: anyone with the job or report URL may retrieve its status and report until the data expires.

Delete

Delete this scan removes a finished scan's job record and files at once. It does not reach backups already taken. Browser-saved reports and local baseline files are not deleted by this action.

Authentication data

The hosted browser form accepts literal credentials only to support throwaway demo accounts. They are scrubbed from the job when it ends and removed from new hosted database backups. Older backups can contain form values from running scans until their 14-day retention expires. Never enter a personal, reused, customer, or production password. Prefer a self-hosted stack for any real login.