> ## Documentation Index
> Fetch the complete documentation index at: https://docs.firecrawl.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Security overview

> How Firecrawl protects your data: zero data retention, DPA, SSO, access controls, and data residency, in one place for your security review.

This page answers the questions a security or procurement team asks before approving Firecrawl. To explore them, reach out to our team on the [Enterprise page](https://www.firecrawl.dev/enterprise).

## Compliance and reports

* **SOC 2 Type II**: our SOC 2 Type II audit is in progress.
* **Trust Center**: the [Firecrawl Trust Center](https://trust.firecrawl.dev) lists our compliance status and controls. You can request the latest penetration test and our Access Control, Data Management, Information Security (AUP), and Third-Party Management policies there.
* **Continuous monitoring**: the Trust Center monitors controls covering data encryption, penetration testing, continuity and disaster recovery plans, data retention procedures, and deletion of customer data when an account is closed.

## Data handling and zero data retention

Zero Data Retention (ZDR) means Firecrawl does not persist page content or extracted data beyond the lifetime of the request or session. It is available on Enterprise plans and must be enabled for your team.

| Product | How to enable | What is not retained | Notes |
| - | - | - | - |
| [Scrape](/features/scrape#zero-data-retention-zdr) | `zeroDataRetention: true` | Page content and extracted data | Screenshots are not available in ZDR mode. Adds 1 credit per page. |
| [Interact](/features/interact#zero-data-retention-zdr) | `zeroDataRetention: true` on the first interact call | Page content and execution output | Session recordings and persistent profiles are not available in ZDR mode. |
| [Search, end-to-end ZDR](/features/search#end-to-end-zdr) | `enterprise: ["zdr"]` | Query and result data, at Firecrawl and at our upstream search provider | 10 credits per 10 results. |
| [Search, anonymized ZDR](/features/search#anonymized-zdr) | `enterprise: ["anon"]` | Query and result data at Firecrawl; the search provider may cache the anonymized query | 2 credits per 10 results. |

[PII redaction](/features/scrape#pii-redaction) can also remove personally identifiable information from scrape and parse output before it reaches you.

## Contracts, DPA, and subprocessors

* **DPA and custom contracts**: Enterprise customers can sign a Data Processing Agreement and custom MSAs, and we support vendor security reviews and questionnaires.
* **Subprocessors**: the current list is published in the [Trust Center](https://trust.firecrawl.dev/subprocessors). Subscribe there to get advance notice before a new subprocessor processes customer personal data.
* **Privacy**: see the [Privacy Policy](https://www.firecrawl.dev/privacy-policy).

## Identity and access control

* **[SSO and SCIM](/features/sso)**: SAML and OIDC single sign-on (Okta, Entra ID, Google Workspace, and more) and SCIM directory sync, so access follows your identity provider.
* **Static IP allowlisting**: route your traffic through dedicated IP addresses that you can allowlist on your systems.
* **[IP restrictions](/features/ip-restrictions)**: limit your team's API keys to an allowlist of IP addresses or CIDR ranges.
* **[Key restrictions](/features/key-restrictions)**: lock individual API keys to specific output formats and endpoints, enforced server-side.
* **Spend limits**: cap spending per API key or per team.

## Monitoring and threat controls

* **[Threat Protection](/features/threat-protection)**: block Firecrawl from fetching risky URLs, using a policy your organization controls and can lock.
* **[SIEM Audit Logging](/features/siem)**: stream a structured audit event for every scrape to your SIEM, starting with Microsoft Sentinel.

## Data residency

Firecrawl processes all data in the United States and does not offer EU data residency. With zero data retention, the content you scrape or search is not stored after the request completes.

## For AI agent and MCP users

The same controls apply when Firecrawl is called from an AI agent, the [MCP server](/mcp-server), the CLI, or an SDK. IP and key restrictions, Threat Protection, and SIEM audit logging are enforced server-side for your organization, so a key restricted to certain endpoints or formats stays restricted whichever client uses it. Zero data retention applies to any request that enables it.

## FAQ

> **Is Firecrawl ready for an enterprise security review?**
>
> Yes. Firecrawl offers zero data retention for scrape and interact plus two ZDR modes for search, signs DPAs, supports SAML or OIDC SSO with SCIM, and has a SOC 2 Type II audit in progress. Server-side controls like IP and key restrictions, Threat Protection, and SIEM audit logging let your security team set and audit policy.

> **Is Firecrawl SOC 2 compliant?**
>
> Our SOC 2 Type II audit is in progress. The [Trust Center](https://trust.firecrawl.dev) lists our current controls and policies.

> **Does Firecrawl offer zero data retention for search?**
>
> Yes. End-to-end search ZDR (`enterprise: ["zdr"]`) has both Firecrawl and our upstream search provider enforce zero data retention, so no query or result data is stored anywhere in the pipeline. See [Search ZDR](/features/search#end-to-end-zdr).

> **Will Firecrawl sign a DPA?**
>
> Yes. Enterprise customers can sign a Data Processing Agreement and custom MSAs. Processing happens in the US. Contact [help@firecrawl.dev](mailto:help@firecrawl.dev).

> **Where is data processed?**
>
> In the United States. Firecrawl offers US data residency and does not offer EU data residency.

> **Who are Firecrawl's subprocessors?**
>
> The current list is in the [Trust Center](https://trust.firecrawl.dev/subprocessors), with advance notice to subscribers before a new subprocessor processes customer personal data.

> **How do we start a security review?**
>
> Request the latest penetration test and policies from the [Trust Center](https://trust.firecrawl.dev), and email [help@firecrawl.dev](mailto:help@firecrawl.dev) or use the [Enterprise page](https://www.firecrawl.dev/enterprise) for questionnaires and contracts.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.