Security
How we keep keys,
sessions and data safe
ProspectAPIs stores API keys only as one-way hashes, signs every webhook with HMAC-SHA256, encrypts connected account sessions and deletes them on disconnect, keeps every customer's data behind row-level security, and never stores a card number. Anyone named in the data can ask to be removed, and every read that returns a person checks that list.
The controls
What protects your account today, and how each one works.
| Area | How it works | State |
|---|---|---|
| API keys | Stored as a one-way hash plus a short prefix. A key is shown once, can be revoked at any time, and cannot be read back by anyone, us included. | Hashed |
| Webhooks | Every watchlist delivery carries an HMAC-SHA256 signature of its timestamp and body, keyed with a secret only you hold, plus a delivery id for dropping duplicates. | Signed |
| Connected accounts | A LinkedIn session you connect is stored encrypted, never returned by the API, used only for the actions you request, and deleted when you disconnect. | Encrypted |
| Database | Every table sits behind row-level security, so one customer's keys, usage, briefs and watchlists are never readable by another. | Isolated |
| Payments | Cards are taken by our payment processor. We receive the result, the amount and a customer reference, never a card number. | Not stored |
| Transport | The API and the site are served over HTTPS only, and a watchlist webhook must be an https URL on a public host. | Encrypted in transit |
Keys and access
- Up to 25 keys per account. Give each system its own key, so revoking one never stops the others.
- Revoke in one click. From API keys in the dashboard; the key stops working on the next request.
- Rate limited. 60 requests a minute per key by default, so a leaked key cannot drain a balance in seconds. A 429 is never billed.
- Spend stops at your balance. Credits are prepaid. A call you cannot pay for gets a 402 and is not charged, so there is no open-ended bill.
- Agents hold their own key. Give each agent a key of its own, so you can revoke it alone. Our guide to researching prospects with an AI agent shows how an agent calls the API.
People in the data
The data is professional information from public pages: company sites, announcements and public profiles. A people read is fetched when you ask, not served from a stored copy. Anyone named can ask for a correction or removal, and the privacy policy sets out the legal basis, the processors we use and how long each item is kept. Use of the data is bound by our acceptable use policy.
Status and disclosure
- API status. The health check answers with the API's state and needs no key.
- security.txt. Our security.txt follows RFC 9116 and names where to send a report.
- Report a vulnerability. Email emma@prospectapis.com with the details and steps to reproduce.
- Changes. Every customer-visible change is on the changelog.
Questions
- Are you SOC 2 certified?
- Not today. This page lists the controls the service runs now, each one a mechanism you can test from your own account, rather than a badge. If your review needs a questionnaire answered, write to us.
- Can your team see my API key?
- No. Only a one-way hash and a short prefix are stored, so a lost key cannot be recovered, only revoked and replaced.
- What do you keep from my research and verification requests?
- Research inputs and the brief are kept so you can read the job again, and are never used to build products for anyone else. A single email check keeps a one-way hash of the address, not the address. The privacy policy lists every item and how long it is kept.
- How does a person get removed from the data?
- By asking. A removal request goes on a list that every read returning a person checks, including funding records, research briefs and people reads.
- How do I report a vulnerability?
- Email the address below or the contact in our security.txt with the details and steps to reproduce. Please do not test against other customers' accounts or data.
More answers on the FAQ page.