Built to clear a pharma security review.
RouteShot handles staging URLs and credentials for regulated brands. We treat that access the way our buyers' own security teams expect, and we're straight about what we do and don't claim.
How your data is protected.
Encrypted, write-only credentials
Staging basic-auth passwords are encrypted, entered write-only from the UI, and never stored or logged in plaintext or read back. You can replace a credential; nobody, including us, reads it.
Per-organization isolation
Every organization's projects, captures, and history are isolated at the database level with row-level security. One tenant's data is never reachable from another.
Complete audit trail
Every capture job records who ran it, when, against which URLs, and the per-page outcome, retained even after the images are cleaned up.
On HIPAA: aligned, not "compliant."
RouteShot captures public and staging marketing pages, not patient data, so HIPAA generally does not apply to what it processes. We still adopt a HIPAA-aligned control baseline, because regulated buyers expect that level of rigor from a vendor with access to their staging environments. We do not claim to be "HIPAA compliant," and we won't, because it would be inaccurate. If your security team needs specifics, we'll walk through the controls.
What RouteShot never does
- Never submits forms or transmits form data on your behalf. Error states are produced by client-side validation only.
- Never stores or logs a staging password in plaintext.
- Never exposes one organization's data to another.
Data handling
Captured images are retained on a defined schedule and cleaned up after; job metadata (the audit trail) is kept. Hosting region and the current subprocessor list are available on request and will be published here as we finalize them ahead of launch.
Need our DPA or a security questionnaire?
We have a DPA and completed security-questionnaire answers ready for review. Request access and we'll send them over.