Skip to main content
This page answers the questions a security or procurement team asks before approving Firecrawl. To explore them, reach out to our team on the Enterprise page.

​
Compliance and reports

  • SOC 2 Type II: our SOC 2 Type II audit is in progress.
  • Trust Center: the Firecrawl Trust Center lists our compliance status and controls. You can request the latest penetration test and our Access Control, Data Management, Information Security (AUP), and Third-Party Management policies there.
  • Continuous monitoring: the Trust Center monitors controls covering data encryption, penetration testing, continuity and disaster recovery plans, data retention procedures, and deletion of customer data when an account is closed.

​
Data handling and zero data retention

Zero Data Retention (ZDR) means Firecrawl does not persist page content or extracted data beyond the lifetime of the request or session. It is available on Enterprise plans and must be enabled for your team. PII redaction can also remove personally identifiable information from scrape and parse output before it reaches you.

​
Contracts, DPA, and subprocessors

  • DPA and custom contracts: Enterprise customers can sign a Data Processing Agreement and custom MSAs, and we support vendor security reviews and questionnaires.
  • Subprocessors: the current list is published in the Trust Center. Subscribe there to get advance notice before a new subprocessor processes customer personal data.
  • Privacy: see the Privacy Policy.

​
Identity and access control

  • SSO and SCIM: SAML and OIDC single sign-on (Okta, Entra ID, Google Workspace, and more) and SCIM directory sync, so access follows your identity provider.
  • Static IP allowlisting: route your traffic through dedicated IP addresses that you can allowlist on your systems.
  • IP restrictions: limit your team’s API keys to an allowlist of IP addresses or CIDR ranges.
  • Key restrictions: lock individual API keys to specific output formats and endpoints, enforced server-side.
  • Spend limits: cap spending per API key or per team.

​
Monitoring and threat controls

  • Threat Protection: block Firecrawl from fetching risky URLs, using a policy your organization controls and can lock.
  • SIEM Audit Logging: stream a structured audit event for every scrape to your SIEM, starting with Microsoft Sentinel.

​
Data residency

Firecrawl processes all data in the United States and does not offer EU data residency. With zero data retention, the content you scrape or search is not stored after the request completes.

​
For AI agent and MCP users

The same controls apply when Firecrawl is called from an AI agent, the MCP server, the CLI, or an SDK. IP and key restrictions, Threat Protection, and SIEM audit logging are enforced server-side for your organization, so a key restricted to certain endpoints or formats stays restricted whichever client uses it. Zero data retention applies to any request that enables it.

​
FAQ

Yes. Firecrawl offers zero data retention for scrape and interact plus two ZDR modes for search, signs DPAs, supports SAML or OIDC SSO with SCIM, and has a SOC 2 Type II audit in progress. Server-side controls like IP and key restrictions, Threat Protection, and SIEM audit logging let your security team set and audit policy.
Our SOC 2 Type II audit is in progress. The Trust Center lists our current controls and policies.
Yes. End-to-end search ZDR (enterprise: ["zdr"]) has both Firecrawl and our upstream search provider enforce zero data retention, so no query or result data is stored anywhere in the pipeline. See Search ZDR.
Yes. Enterprise customers can sign a Data Processing Agreement and custom MSAs. Processing happens in the US. Contact help@firecrawl.dev.
In the United States. Firecrawl offers US data residency and does not offer EU data residency.
The current list is in the Trust Center, with advance notice to subscribers before a new subprocessor processes customer personal data.
Request the latest penetration test and policies from the Trust Center, and email help@firecrawl.dev or use the Enterprise page for questionnaires and contracts.