Security & Data Handling

This page describes what actually happens to data sent to Aervik Labs APIs and where the reference data behind our products comes from. We'd rather tell you plainly what we do and don't do than make broad claims we can't back up — if a claim isn't true today, it isn't on this page.

What we store, and what we don't

Request content — the text, PDF, or image you send to an endpoint — is processed only as needed to generate a response. It is not stored in a database and not logged in identifiable form once the response is returned. The one exception is a requirement profile you choose to save with COI Verification’s POST /requirements: it is stored so you can reuse it by id. This is the standard data-handling policy across every Aervik Labs API, stated in each unit's own Terms of Service (served at that API's /terms endpoint).

Our PII Redaction API makes the strongest version of this commitment, since its entire purpose is handling sensitive content: no database, no logging of request bodies, and no retention of input text, output text, or detected entities once the response is returned.

Where an AI model reads your request, our model provider sees it. The products that use a model — COI verification, invoice and receipt extraction, resume parsing, PII redaction, the landed cost estimator, and the context notes on SEC Form 4 and EPA results — send the request content (or, for SEC and EPA, the public record being summarized) to our model provider, Anthropic, to produce the response. (Checked against each product’s deployed configuration, 2026-09-11.) Anthropic processes it under its own API data-retention policy. We don’t store it. The other parties in the path, for completeness: every request passes through RapidAPI and Cloudflare, and a name or company you screen is sent as the query to the government source being checked (for example, trade.gov’s screening API).

Our error logs record only the type and message of a failure (for example, "network error calling the classification model") so we can debug real problems — never the content of the request that triggered it.

Some of our products do maintain a database — but it caches public reference data our products are built on, such as government exclusion lists or tariff schedules, refreshed periodically so lookups are fast. That's public data we're indexing to answer your query, not anything about you or your request — apart from a COI requirement profile you choose to save, described above.

We never collect or store payment information ourselves. Every Aervik Labs API is billed through RapidAPI, which handles subscription management and payment directly — we never see your card details.

Where our source data comes from

Every data source we use is either an official government API, a public-domain government publication, or explicitly licensed data — never a scraped list or user-generated content. Examples from our own internal sourcing log:

We log the license basis for every data source we use, including honoring published rate limits and required request headers where a source specifies them.

Encryption in transit

Every request to aerviklabs.com and every Aervik Labs API runs over HTTPS, served through Cloudflare's network. We don't offer, and never have offered, a plain-HTTP endpoint for anything customer-facing.

Authentication & rate limiting

Every Aervik Labs API is published and sold through RapidAPI and requires a valid RapidAPI key. Requests without one are rejected at RapidAPI's own layer before they ever reach us, and that same layer enforces your subscription tier's request limits. We don't run a separate, undocumented limit on top of it.

Any free interactive tool on this site (no account or key required, linked from the relevant product page) is limited to a small number of requests per IP address per day, specifically to prevent abuse of a public, unauthenticated endpoint — the same discipline we apply to every API, just enforced differently since there's no account to key it to. Two are live: the certificate of insurance checker and the landed-cost estimator.

What we don't promise

We're a small, early-stage operation, and we'd rather say that plainly than overstate what's in place:

• No uptime guarantee or formal SLA. We don't offer one today, and we won't promise one we can't personally stand behind.
• No third-party security certification. We don't currently hold a SOC 2 report or similar independent audit. If that's a hard requirement for your use case, this isn't the right product for you yet.
• No custom contracts. Every customer uses the same published terms and the same infrastructure; we don't offer bespoke agreements.

Reporting a security or privacy concern

If you find a real security issue or have a question about how your data is handled, email aerviklabs@gmail.com. The same contact is published in machine-readable form at /.well-known/security.txt.

This page describes our actual practices as of the date above and was drafted by the AI agent that operates this business, checked directly against the current code and configuration rather than written from a template. It is not a substitute for your own security or compliance review appropriate to your use case, and it isn't legal advice.