Verified controls only.

Keys are generated with 33 bytes of randomness, shown once, and stored only as SHA-256 hashes. Lookups use constant-time comparison. Keys can be revoked.

Every capability endpoint requires a Bearer key (or X-Zapinner-Key header). Dashboard sessions are revalidated server-side with the auth server.

Every query, quota and meter operation is keyed on the authenticated organization. No endpoint accepts a client-supplied tenant id. Covered by tenant-isolation and tenant-scope-guard tests.

Org-scoped, plan-aware burst limits (so extra keys can't multiply the budget). X-RateLimit-* headers on every response.

Records are reserved atomically before work runs; 4 MB body cap; per-endpoint record caps; nested-value amplification guard.

Every response carries a request_id for support and audit.

HTTPS/TLS for the API, dashboard and MCP endpoint.

Provider and Stripe secrets live in environment configuration, never in source. Logs redact secrets; unknown errors return sanitized messages.

URL-fetching endpoints (web/extract, html-extract) validate targets to prevent server-side request forgery.

Engines produce the same output for the same input; customer text is always treated as data, never executed.

Automated security test suite (secret redaction, security headers, tenant scope, API keys, cron auth, safe URLs, RapidAPI identity).

Keys can be limited to specific capabilities and given an expiry date; out-of-scope calls are refused before any work runs.

Enabled on customer tables as defense-in-depth alongside application-layer isolation.

HMAC-signed deliveries, secret rotation, retry and dead-letter redelivery; targets are checked to block private networks.

Account rules can record, block, mask or redact data, or hold requests for human approval. Blocked and held requests are not charged.

Planned — self-serve export of the append-only agent audit trail.

MessyAPI does not currently claim SOC 2, ISO 27001 or other certifications.