Security
Security at the platform level
Security is part of the architecture, not a checklist bolted on afterwards. This page describes our current practices in plain language.
API credential security
API keys are generated with 192 bits of entropy, displayed exactly once and persisted only as SHA-256 hashes. Rotation is instant and self-serve. Keys never appear in logs, error messages or analytics.
Encryption in transit
All traffic — from your client to the platform and across every internal hop — is encrypted with TLS 1.2+. Plaintext HTTP is not accepted on any endpoint.
Isolated, minimal infrastructure
The platform runs on isolated per-request execution at the network edge. There are no long-lived servers to patch, no SSH access, and the management plane is separated from the data plane.
Data minimization
We log operational metadata (endpoint, status, latency, request ID) — not response payloads. Billing card data is handled entirely by Stripe and never touches our systems. Sign-in is delegated to Google, GitHub and LinkedIn; we never see or store passwords.
Traceability
Every response carries an X-Request-Id that our team can correlate end to end across the platform — support investigations do not require you to share payloads.
Compliance posture
Our data handling follows GDPR principles (see the Privacy Policy for the full picture, including subprocessors). A Data Processing Agreement is available for Enterprise customers. SOC 2 readiness is on our roadmap; we do not claim certifications we do not hold.
Responsible disclosure
If you believe you have found a security vulnerability, email security@endpointry.com with enough detail to reproduce the issue. We acknowledge reports within 2 business days, keep you informed while we investigate, and will not pursue legal action against good-faith research that respects user privacy and avoids service disruption. Our machine-readable policy lives at /.well-known/security.txt.
Related: Privacy Policy · Service Level Agreement · Status page