What we do with your request and response data

• Authentication attempts and authorization decisions: which client called which endpoint version, and whether it was allowed.
• Request and response records, including the headers and bodies your client library sends. You choose what it sends.
• Error reports from your applications.
• Your configuration: applications, endpoints, environments, grants, packages and notification settings.
• API credentials, as irreversible hashes only. Nobody, us included, can read a secret back from them.

Masking rules redact values before they are stored, and you decide where they apply. Do not send payment card or health data: the service is not designed to protect it.

Request and response history is kept for your plan's retention period, then deleted:

On plans that keep history longer than 90 days, request and response bodies older than 90 days move to an archive in Amazon S3 until the period ends. Usage counts and summary analytics are kept while your account is active.

Moving to a plan with a shorter period deletes the older data, and that cannot be undone. Cancelling a paid plan deletes your organization's operational data at the next daily cleanup.

The service, its databases and the body archive are hosted on Amazon Web Services in the United States (us-east-2), in a private network with access restricted to the service. Data in transit is protected with TLS. EndPointBlank is offered to customers in the United States.

• Members of your organization, according to the roles and groups you set up.
• The other side of a connection: when one organization calls another's API through EndPointBlank, each side sees the connection, the contacts it shares, and the records of the calls between them.
• A provider that created your organization as a managed account, which can manage it through the management API until you claim it.
• The Slack, Teams and email destinations your organization configures for notifications.
• Anyone a subpoena, court order or other legal process requires us to disclose it to.

You keep all rights to your data. We use it only to provide, secure, support and improve the service for you. We do not sell it, use it for advertising, or share it with third parties for their own marketing.

Amazon Web Services (hosting), Stripe (payments; we never see full card numbers), Mailgun (email), Telnyx (SMS sign-in codes, if you use them), Google (Google sign-in, if you use it, and analytics on the public pages only), and Slack (our own team's notice of new sign-ups and support messages).

• Passwords are stored with bcrypt. Passkeys store only your public key.
• API secrets and tokens are stored as keyed, irreversible hashes. Rotate a secret with a grace window and the old one keeps working for 7 days, or until you revoke it.
• Sign-in codes are stored as keyed hashes and expire after 10 minutes.
• Sign-in cookies are marked Secure. "Remember me" keeps you signed in for at most 60 days.

If a breach affects your personal information, we will notify you and any required authorities as the law requires. To report a vulnerability, email support@endpointblank.com.