Last updated: 19 October 2026
This page describes how Uiprobe ("we", "us") protects the security of the Uiprobe service and the data it processes, and how we receive and respond to reports of security vulnerabilities. It applies to the Uiprobe web application, the Chrome extension, the Figma plugin, and the probe processing service operated by us. It does not cover third-party software you install or third-party services you connect to Uiprobe.
We build Uiprobe on Google Cloud, Supabase and Vercel, and use a small number of other providers for sign-in, payments, analytics, email and support. The full list, with what each provider does and where it processes data, is on our Subprocessors page. Each provider maintains its own security program and certifications.
We do not collect cookies, local or session storage, login credentials, session tokens, or network traffic from the pages you probe.
All connections to Uiprobe are encrypted in transit with TLS. This includes connections from end-user browsers, the Chrome extension, the Figma plugin, and all internal traffic between Uiprobe services and our subprocessors.
Screenshots and design data are stored in Google Cloud Storage, and records in a Postgres database hosted by Supabase. Both are encrypted at rest with AES-256, using keys managed by the provider. We do not add our own encryption layer, and customer-managed keys are not supported.
Uiprobe captures only the data needed to compare a Figma design with a webpage. When our servers capture a page, they use a browser with no cookies or stored logins. Pages behind a login are captured with the Chrome extension, inside your own browser tab, and your session never leaves the browser.
Uiprobe offers no automatic masking of personal data. Run probes on staging environments or test accounts with synthetic data, and do not probe pages that show real personal, financial or health data.
We do not copy content from your probes into our email or customer relationship tools, or into AI assistants. When a support request needs it, we add it to the support ticket in ClickUp.
We keep a probe and its data for as long as the probe exists. Deleting a probe in the app removes it from your account straight away; its stored files are erased when you ask us to erase your data. When you ask us to erase your account or its data, we erase the database records and stored files within 30 days and confirm when it is done. Copies in our backups expire within 90 days. Invoices are kept for seven years, as Dutch tax law requires.
Uiprobe uses Google Gemini, through Google Cloud's Vertex AI, at specific steps of a probe run: to divide a page into sections and to describe visual differences. Gemini receives images only: the Figma frame image, the webpage screenshot and crops around visual differences. It receives no page text, element data, URLs or account data beyond what is visible in those images. Under Google Cloud's terms, this data is not used to train Google's models. We do not train AI models on your data, and the product uses no other AI providers.
The extension works only on the tab you start a capture on, and only after you click it. It has no content scripts and cannot see other tabs, other sites or your browsing history. It asks for these permissions:
It does not request access to cookies, tabs, history or network requests.
All customers' data is stored in one database and one storage service, separated logically. Every request is checked against your account and team. Database row-level security blocks direct access to other users' records, and stored files can only be reached through time-limited signed links.
The database is backed up by our provider and, in addition, every day to Google Cloud Storage in the EU. These daily copies are kept for 90 days. The applications can be redeployed from source control at any time.
We review security before every release, following a written checklist that covers dependency audits, database access policies and every new API route. We have not yet commissioned an external penetration test.
If we determine that an incident has resulted in unauthorized access to or disclosure of customer data, we will notify affected customers without undue delay, and within 72 hours of becoming aware of it, in accordance with applicable law and the terms of our customer agreements. Where we act as a processor on behalf of a customer, we will notify that customer in line with our data processing agreement.
If you find a security vulnerability in Uiprobe, email privacy@uiprobe.io with a description and the steps to reproduce it. Please do not access other users' data or disrupt the service while testing, and give us reasonable time to fix the problem before disclosing it.
Application and infrastructure logs are retained to support incident detection and investigation. Access to logs is restricted to authorized personnel.
Uiprobe is not currently independently audited against SOC 2, ISO 27001, or similar frameworks. Our subprocessors maintain their own certifications. Uiprobe is not suitable for protected health information and cannot sign a HIPAA Business Associate Agreement.
We offer a data processing agreement based on the European Commission's standard contractual clauses. Email privacy@uiprobe.io to request it.
We may update this page from time to time. The "last updated" date above reflects the most recent change.
Security, privacy and data protection: privacy@uiprobe.io
This page describes our security program at a high level for informational purposes. It does not form part of any contract and does not create any warranty, representation, or commitment beyond those in our written agreements with customers. To the extent of any conflict between this page and a written agreement, the written agreement controls.
The fastest way to see how your implementation compares to the design. No screenshots, no guessing
Compare
© 2026 · Built by UIPROBE
