Security you can understand.

RichAPI handles API keys, customer data, enrichment requests, and third-party data providers. We keep access controlled, customer data separated, and sensitive information out of our logs.

Ask a security question

Security questions: security@richapi.ai

Last updated September 30, 2026

Access & isolation

Your account and data stay yours.

API keys

Every workspace has its own API keys. Keys can be rotated or revoked from the dashboard, and revoked keys stop working immediately.

MCP access

MCP connections use OAuth instead of exposing your RichAPI API key. Disconnecting a connection revokes its access.

Separate customer workspaces

Each workspace has its own credentials, requests, usage, and billing information. Customers cannot access another customer's data or credentials.

Limited logging

Our logs hold operational details like request status, timing, usage, and errors. API keys, secrets, and personal data are removed wherever possible.

Subprocessors

Know what happens to your data.

RichAPI uses third-party providers for enrichment and infrastructure. Depending on the request, data may be sent to the provider needed to complete it.

We can provide a detailed subprocessor list for security reviews.

Our main infrastructure providers

  • AWSAPI infrastructure
  • CloudflareMCP and edge infrastructure
  • SupabaseAuthentication and account infrastructure
  • StripePayments
  • SentryError monitoring

Reliability

We design for failure too.

Third-party providers can go down. APIs can fail. Requests can time out.

RichAPI is designed to handle these situations without bringing down the whole system.

  • Provider protection: failing providers can be stopped and replaced where supported.
  • Rate limits: help prevent unexpected spikes and abuse.
  • Failed requests: errors (non-2xx) and email or phone finder misses cost nothing.
  • Signed webhooks: let your application verify RichAPI webhooks.
  • Deployment checks: changes are tested before going to production.

Payments

Payments are handled by Stripe.

RichAPI does not store your full card details. Payments and card information are handled by Stripe.

Your RichAPI account stores billing information such as purchases, credits, invoices, and usage.

Privacy

Privacy and data removal.

RichAPI processes business information such as company details, professional profiles, domains, and work email addresses depending on the service you use.

We use third-party providers to retrieve this information and don't operate a public bulk directory of people.

For privacy or data removal requests: privacy@richapi.ai

Compliance

Compliance, without the buzzwords.

RichAPI is a product of TexAu, and our compliance runs through TexAu's security program.

GDPR
DPA available
SOC 2
Through our parent company, TexAu. Report on request for enterprise customers.
Data residency
API infrastructure runs on AWS in the EU region. Some upstream data providers process lookups outside the EU.
Penetration testing
Through TexAu. Summary on request for enterprise customers.
Data retention
Request logs are purged after 30 days.
Payment security
Card payments handled by Stripe

RichAPI holds no certification of its own. Enterprise customers can request TexAu's SOC 2 report and pen test summary.

Need security documentation?

If you're evaluating RichAPI and need a DPA, security documentation, or help with a security questionnaire, contact us.

security@richapi.ai