What "Privacy-First" Actually Took to Ship GraceSoft Capture

“Privacy-first” is easy to put on a landing page. It’s harder to prove.

So instead of repeating the phrase, here’s what it looked like in the final stretch before GraceSoft Capture v2 launched. None of this is flashy, and most customers will never see it. That’s sort of the point.

Spam protection that doesn’t punish real people

Every public form attracts bots. The usual fix is a CAPTCHA that makes your actual customers click on traffic lights.

Capture uses Cloudflare Turnstile, which checks for bots quietly in the background and only asks for interaction when it really needs to. On launch day I also made sure the widget renders in the light theme, so it sits naturally inside the form instead of looking like a foreign object.

Secrets never leak into tests

Capture talks to Stripe for billing and Turnstile for spam protection. In development, those keys live in a local environment file, and a common, quiet mistake is letting the test suite pick them up.

Capture’s tests now deliberately blank those keys, so local values can never bleed into a test run.

Test emails never reach real inboxes

During development, every email goes to Mailtrap, a sandbox inbox. In production, mail goes out through Postmark, a service built for transactional email.

That means I can test sign-up, password reset and reply flows freely, with no risk of a test email landing in a real person’s inbox. Login and verification emails are also queued, so a slow mail server never holds up someone trying to sign in.

Transparent paperwork

Capture’s Data Processing Agreement is now at v1.1, and the security page lists every sub-processor, updated for the new email setup.

If your business has PDPA obligations, you shouldn’t have to email a vendor and wait a week to find out who handles your customers’ data. It should be written down, in plain language, before you sign up.

Patched, not postponed

Two dependency updates went in on launch day: one to address a published security advisory, and one to keep deploys healthy. Neither was on fire. That’s exactly when to fix them.

Checks run where it counts

Tests run against PostgreSQL, the same database used in production, and the full checks run on the production branch. If something would break for customers, it should break in CI first.

Why bother?

A form is often the very first time a customer trusts a business with their details. If you use Capture, you’re passing that trust on to me. This is how I try to honour it.