Security
Jetscrape.com — Version 1.0 | Effective date: 23 September 2026
Payments never touch our servers
Card payments are processed by MPSS ödeme kuruluşu, a payment institution licensed in Türkiye, through 3-D Secure.
Card number, expiry and CVV are submitted inside the payment institution's own verification flow. They are not stored on our servers, not written to our logs, and not visible to our staff. What we receive back is the transaction result and a masked card number — enough to show you which card paid, and nothing more.
Your account
- Passwords are stored only as salted hashes. Nobody at Jetscrape can read your password.
- Two-factor authentication is available and we recommend enabling it.
- Sessions are held in secure, HTTP-only cookies and can be revoked.
- API keys are scoped and carry per-key budgets, so a key that leaks cannot spend more than the limit you set on it. Keys can be rotated or revoked at any time, and every key's usage is visible in the dashboard.
Data in transit and at rest
All traffic to jetscrape.com, to the API and to the MCP endpoint is encrypted with TLS. Internal service-to-service traffic stays inside the provider network.
Scraping results are stored for the window your plan defines — 24 hours on Free, 7 days on Starter, 30 days on Growth, 90 days on Scale — and are deleted automatically when that window closes. We do not use the content you extract for our own purposes and we do not use it to train models.
Personal data is deleted or anonymised one month after an account is closed, except where tax and accounting law requires us to keep records for longer.
Access control
Access to production systems is limited to the engineers who need it, authenticated individually, and logged. Administrative interfaces are not publicly reachable. We separate credentials by environment, so development never holds production secrets.
Tracking and consent
No analytics or chat script loads before a visitor consents. If you reject cookies, no third-party request is made at all. See the Cookie Policy for the full list of what loads after consent and what each cookie does.
What we ask of you
Most incidents start with a credential, not an exploit.
- Give each integration its own API key, with the smallest budget that works.
- Rotate keys when someone leaves your team.
- Never commit a key to a repository or paste it into a chat, an issue or a support ticket. If you do, revoke it immediately — a revoked key costs nothing, a leaked one can cost a lot.
- Turn on two-factor authentication.
Reporting a vulnerability
If you believe you have found a security problem, write to privacy@jetscrape.com with enough detail to reproduce it. Please give us a reasonable opportunity to fix the issue before disclosing it publicly.
We will acknowledge your report, keep you updated while we investigate, and tell you when it is resolved. We will not pursue legal action against researchers who report in good faith, act proportionately, and do not access, modify or retain other people's data.
Incidents
If a security breach affects your personal data, we will notify you and the Personal Data Protection Authority within the periods required by the KVKK, and tell you what happened, what data was involved, and what we are doing about it.
DEMRE TARIM TURİZM TEKSTİL GIDA İNŞAAT KUYUMCULUK BİLİŞİM EMLAK İTHALAT İHRACAT SANAYİ VE TİCARET LİMİTED ŞİRKETİ MERSİS 0291065649900023 · Demre Tax Office 2910656499 Altınova Sinan, Bilgin Sk. No:29, 07170 Kepez / Antalya, Türkiye