Security
Updated 3 November 2026.
Keys and sign-in
API keys are encrypted at rest with AES-256-GCM. Each request finds its key by the key's SHA-256 hash, so checking a key never decrypts it. You can reveal a key again in the dashboard whenever you need it, and a revoked key stops working on its next request.
There are no passwords. You sign in with a one-time email link that expires after 15 minutes. We store only the SHA-256 hash of its token, so a copy of our database holds no working link. A signed-in session lasts up to 30 days.
Query text
The text of each query is kept for 90 days and then deleted. The rest of the usage record, its cost, status and timing, stays with your billing history.
Owners and admins can shorten the window to 7 or 30 days, keep the full 90, or stop storing query text altogether, in Settings under Data & privacy. With storage off, the log still shows each request's cost and status, but not its text.
A retry with an idempotency key gets the stored response for 24 hours; the response is then deleted.
Closing an account or organisation
You can close your account yourself in Settings under Data & privacy. It happens at once: your keys are revoked, your email and name are removed, your sessions end, and stored query text is cleared. A personal organisation with no other members closes with it. If you are the only owner of an organisation that has other members, transfer ownership first.
An owner can delete an organisation. Its keys are revoked, its invitations cancelled and its members removed.
Either way, any remaining balance is forfeited, as the terms set out. The ledger and receipts are kept for 5 years, as Singapore law requires.
Processors
These service providers process data on our behalf, each under a data-processing agreement.
| Role | What it handles |
|---|---|
| Hosting | Runs the website and the API. |
| Database | Accounts, organisations, encrypted keys, usage records and the ledger. |
| Payment processor | Card details, payments, and the billing details you enter at checkout. |
| Email delivery | Sign-in links, receipts and account notices. |
| Search and scraping engines | The query or URL of each request, never your identity, email or key. |
| Ranking service | The query and result snippets, to choose and order results. |
The privacy policy lists what each request sends and what we collect.
Where data lives
The service and its database run in the United States, in the US East region. Service email is sent from the United Kingdom. Card details stay with the payment processor and never reach our servers.
Reporting a vulnerability
Email support@paperfoot.comwith “Security” in the subject. Include the affected page or endpoint, the steps to reproduce the issue, and what an attacker could gain. Test only against your own account, and do not access other people's data or degrade the service.
We reply to every report, usually within a few working days, and tell you when the issue is fixed. Please give us time to fix it before you publish it. Our contact details are also published at /.well-known/security.txt.
Data processing agreement
A data processing agreement is available on request. Write to support@paperfoot.com.