Security &
Data Handling
Where HC IntelLab keeps your research, how it is protected, and what the HC Capture Intel browser extension can and cannot see.
Data location
European data centre
In transit
Encrypted with HTTPS (TLS)
Sign-in
Magic link, no passwords stored
Backups
Regular, kept in Europe
Hosting & Data Location
Your notebook, entities and collections stay in Europe.
Hosted in Europe
The HC IntelLab application and its database run in a European data centre. Captured highlights, notes, entities, observables and collections are stored there.
Backups stay in Europe
Data is backed up regularly so it can be restored after a failure. Backups are also kept in Europe.
On-premises option
Teams that cannot use a hosted service can run HC IntelLab on their own infrastructure, including air-gapped networks, with the On-Prem plan. In that setup your data never leaves your environment.
Encryption in Transit
Everything sent to HC IntelLab travels over an encrypted connection.
HTTPS everywhere
The web app, the browser extension and the Data API all talk to HC IntelLab over HTTPS (TLS), so highlights, notes and API keys cannot be read on the network between you and our servers.
Sign-in & Access
There are no passwords to steal, and keys can be revoked at any time.
Magic-link sign-in
You sign in with a one-time link sent to your email address. HC IntelLab does not ask for or store a password.
API keys are shown once and can be revoked
The API key that connects the browser extension is shown in full only once, when you create it. After that the app displays and keeps only its first characters; the full key is held by our API gateway, which checks it on every request. You can revoke a key from your account at any time.
Separate secret for every Data API
On the Enterprise plan each Data API feed has its own secret auth code, so access to one feed can be withdrawn without affecting the others.
Private by default
Your research is visible only to you. On the Enterprise plan it is shared only with the team members you invite to your workspace, and team data stays with the plan when someone leaves.
Browser Extension
HC Capture Intel sends data only when you choose to save something.
Captures only what you save
The extension sends the text you highlighted, the notes, tags and entity links you add, and the page URL, domain, title and capture time. Nothing is sent until you save.
On-demand mode needs no all-sites permission
Automatic mode asks for access to all sites so the capture bar can appear when you highlight text. If you prefer, turn it off: the extension then runs only on the page where you right-click and choose to save.
What it does not collect
The extension is not designed to collect passwords, payment-card details, cookies, authentication tokens, form entries, private messages or your browsing history.
Payments & Third Parties
We keep the number of outside services that touch your data small.
Card details never reach us
Payments are processed by our payment provider, Dodo Payments. Card details are entered on their checkout and are never seen or stored by HC IntelLab.
No third-party trackers in the app
The HC IntelLab app loads no advertising or analytics trackers. Icons and fonts are served by the app itself, so the sites in your notebook are never disclosed to an outside service. The sign-in page uses Cloudflare Turnstile to block automated sign-ins.
Your data is not sold
We do not sell or rent your personal information or captured intelligence, and we do not use it for advertising.
Your Data, Your Control
You can take your research with you or remove it.
Export on every plan
Entities, threat actor profiles and malware profiles can be exported as JSON or Markdown, with analyst notes and source pages included. Export is available on every plan, including Community.
Deletion
You can delete saved records from your workspace. To close your account and have its data deleted, email us; details and retention periods are in the Privacy Policy.
Report a Vulnerability
If you find a security issue in HC IntelLab or the HC Capture Intel extension, email us with the details and steps to reproduce it. We aim to reply within 24 hours. The same address works for any security question this page does not answer.
[email protected]This page describes how HC IntelLab works today and is updated when that changes. For how personal data is collected, retained and deleted, see the Privacy Policy.