Security

Your captures

VizShot has no cloud of its own. Captures are saved on your computer, and uploads go only to storage you own, straight from your computer, signed with your own access key. The secret part of that key never leaves your computer: it is kept in the macOS Keychain or the Windows Credential Manager, used to sign each upload, and never sent. Upload addresses are random, so nobody can guess a link from a date or a file name.

Your license key

The key is kept in the same secure credential store, never in a plain file. The app talks to our license service only over HTTPS, and believes it is activated only when our server’s signed answer checks out against a key built into the app, for that computer. So a fake server, a meddling network or an edited file can’t switch a copy on, and copying VizShot to another computer doesn’t copy the activation. The Privacy Policy lists everything these checks send.

What the app sends

By itself, only what the license check and, on a Mac, the update check need. A problem report goes only when you press Send: before it leaves your computer the app takes folder names, links and your storage details out of its log, and “Show what will be sent” opens the exact text. Usage counts and crash reports go only if you turn on “Help improve VizShot”, under a random ID that is not the one your key uses. On our side these routes are limited in how much one network can send and in how much is kept in total, so a flood of them is turned away rather than left to fill the server. The Privacy Policy has the full list.

The app you install

• Mac: signed with our Apple Developer ID, notarized by Apple and protected by the hardened runtime, which stops other code being slipped into it. It asks for screen recording, and the microphone only if you record it.
• Windows: installed from the Microsoft Store, which checks and signs the package.
• Updates (Mac): every update is signed, and the app refuses one whose signature doesn’t match the key built into it, so not even a hacked website could push code to your Mac.
• The app’s windows show only what ships inside the app, never web content, and can do only what they need.

This website

Everything is served over HTTPS. You sign in with single-use email links, never a password. License keys are stored encrypted, the admin area needs a second factor, and we keep no card details: Dodo Payments takes payment.

Report a security problem

If you think you have found a security problem in VizShot or this website, email [email protected] with “Security” in the subject. Tell us what you found and how to reproduce it. We reply within three working days and keep you posted until it is fixed.

Please give us a reasonable time to fix it before telling anyone else, and don’t access other people’s data, disrupt the service, or run automated scans against it. We won’t take action against anyone who reports a problem in good faith this way.