Security.

API keys

• API keys are server-side bearer credentials. Send them in an Authorization: Bearer header from your backend; do not embed them in browsers or mobile apps.
• A new key is shown once, when you create it. We store only a lookup prefix and an HMAC-SHA-256 hash of the key, so we cannot show it to you again or recover it. If you lose a key, rotate it.
• You can revoke or rotate keys at any time from the dashboard; a revoked key stops working immediately.
• Full key secrets are kept out of logs, analytics, error reports, and support tooling.

Accounts

Dashboard sign-in uses email and password. Passwords are stored as salted PBKDF2-SHA-256 hashes, never in plaintext, and password resets go through a single-use emailed link. Paid billing runs through Stripe Checkout and the Stripe billing portal; card numbers never touch our servers.

Transport and abuse protection

The website, dashboard, and Places API are served over HTTPS (TLS) only. The Places API enforces per-account rate limits, a per-account concurrency cap, and a limit on repeated failed authentication attempts from one IP. Operational and admin endpoints are not reachable from the public internet.

Request data

Usage records keep request metadata such as status, query text, and rounded coordinates rather than full request URLs. See the privacy policy for what we collect and how long we keep it.

Infrastructure providers

• Cloudflare for the website, dashboard, workers, DNS, and edge;
• PlanetScale Postgres for account, key, quota, billing, and usage records;
• Hetzner for Places API hosting;
• Stripe for checkout, subscriptions, invoices, and the billing portal;
• Resend for transactional email;
• PostHog for product analytics and browser error reporting;
• Sentry for error reporting and alerting;
• Google Analytics for aggregate website traffic measurement.

Reporting a vulnerability

Email support@openplacesapi.com with a description, the affected URL or endpoint, and steps to reproduce. Please do not access other people's data, degrade the service, or run automated scans that generate heavy traffic. We will acknowledge your report and follow up while we work on a fix. There is no paid bug bounty.

If you think one of your API keys has been exposed, revoke or rotate it in the dashboard first, then let us know.