Security
How we protect your keys, data, and payments.
API key storage
- API keys are never stored in plain text. When you generate a key, we show it to you once — then it's gone from our systems. What we store is a cryptographic hash of the key, which can verify your requests but cannot be reversed to recover the original.
- If you lose your key, generate a new one. There is no recovery mechanism — by design.
Transmission security
- All API traffic and web requests are served over HTTPS with TLS. HTTP requests are redirected automatically. We enforce HSTS so browsers remember to use HTTPS.
Infrastructure
- RankParse runs entirely on Cloudflare's global edge network — one of the most hardened infrastructure providers available. Your API requests are handled at the Cloudflare edge closest to you, with Cloudflare's DDoS protection, WAF, and network isolation applied by default.
- We do not operate our own servers in the request path. There is no custom network stack to misconfigure or physical hardware to breach.
Rate limiting
- Every API key is rate-limited independently. Abuse from one key cannot affect another. Rate limit state is enforced at the edge, not in application logic, so it cannot be bypassed by routing requests through different regions.
Payment security
- Payments are processed by Stripe. We never see, handle, or store your card number, CVV, or billing address. Stripe is PCI DSS Level 1 certified — the highest level of payment security certification available.
Account data
- We store the minimum required to operate the service: your email address, a hash of your API key(s), and your usage logs. We do not store IP addresses linked to your account. Usage logs are retained for 90 days.
Responsible disclosure
- Found a security issue? Email support@rankparse.com with a description of the vulnerability. We will respond within 2 business days, keep you updated as we investigate, and credit you if you'd like.
- Please do not publicly disclose issues before giving us a chance to fix them.