APITier API security practices: HTTPS-only access, API key authentication, GDPR-compliant data handling, rate limiting, and responsible disclosure policy.
All requests to the APITier API require an X-Api-Key HTTP header containing your account API key. Requests without a valid key return a 401 Unauthorized response.
API keys are generated when you create an account and are displayed in the Dashboard under API Keys. You can create additional keys or revoke existing ones at any time.
Yes — API keys can be rotated from the Dashboard at any time. After generating a new key, the old key remains valid for a short grace period to allow you to update your integrations.
No. Treat your API key as a secret credential. Use environment variables or a secrets manager (AWS Secrets Manager, Doppler, Vault) to inject the key at runtime. If a key is accidentally exposed, rotate it immediately from the Dashboard.
Yes — all API endpoints and web pages are served exclusively over HTTPS using TLS 1.2 or higher. HTTP connections are automatically redirected to HTTPS.
APITier supports TLS 1.2 and TLS 1.3. TLS 1.0 and 1.1 are not accepted. We recommend TLS 1.3 for new integrations.
No. Personal data submitted through validation APIs — email addresses, phone numbers, names, addresses — is not stored beyond the API request/response cycle. It is used only to perform the lookup and return the result.
Yes. APITier operates from the UK and complies with UK GDPR. Validation APIs do not persist personal data. API usage metadata (endpoint called, timestamp, credit consumed) is retained for billing and abuse prevention purposes only.
API requests are processed in UK/EU infrastructure. Some underlying data sources (VIES, Companies House) are queried via their official EU/UK government APIs as part of request handling.
Yes — contact support at hello@apitier.com to request account and data deletion. We will process requests within 30 days in accordance with UK GDPR requirements.
Yes — rate limits apply per API key. Free tier accounts have lower per-minute limits than paid plans. Exceeding the rate limit returns a 429 Too Many Requests response with a Retry-After header.
If you suspect your API key has been compromised, rotate it immediately from the Dashboard. Contact support at hello@apitier.com if you observe unexpected usage on your account.
Please email security findings to hello@apitier.com with the subject line 'Security Disclosure'. Include a description of the vulnerability, steps to reproduce, and potential impact. We will acknowledge receipt within 48 hours and aim to resolve confirmed issues within 30 days.
We do not currently operate a formal bug bounty programme. We appreciate responsible disclosure and will acknowledge researchers who report valid vulnerabilities.
Security questions? hello@apitier.com or visit Support.