Security and trust

AnyAPI is prepaid. You add funds to a USD wallet and each request is charged against your balance at the per-request price shown in the catalog.

Top-ups are collected on Stripe's hosted checkout page, and Autumn is our billing provider. Card details are typed into Stripe's page, not ours, so no card number ever reaches an AnyAPI server. We do not store card numbers, expiry dates, security codes, or the last four digits. What we keep is Stripe's identifier for the payment, the amount in USD, and the timestamp.

AnyAPI holds no security certification. We are not SOC 2 audited, ISO 27001 certified, or independently penetration tested, and this page is the whole of what we claim.

Because collection happens on Stripe's own page, the gateway only ever handles Stripe's tokens: the identifier of the payment and, if you save a card, the identifier of the saved payment method. Those identifiers are useless outside our Stripe account.

Automatic top-ups are off unless you turn them on. When they are on, our billing provider charges the saved payment method without you present, and you can switch automatic top-ups off or change the amount in the dashboard at any time.

Stripe tells us a payment completed over a webhook. Every webhook payload is checked against our endpoint signing secret before the wallet moves, and a payload that fails the check, or arrives when no signing secret is configured, is rejected.

You decide what the Service retrieves; we act on your instructions. Traffic to getanyapi.com and to the gateway at api.getanyapi.com is served over HTTPS. The website runs on Cloudflare. The gateway runs on our own server in Microsoft Azure in the United States, and its database runs on a separate machine on a private network with no port open to the internet.

We keep one record per request: the endpoint you called, the parameters you sent, the response status, how long it took, the amount charged, and which API key made the call.

We keep the response to each paid request for the window you choose in the dashboard: 3 days unless you pick 7 days or none. You can read it back through the API or the dashboard within that window. Lowering the setting hides older responses at once. A copy is also kept for 24 hours, whatever the setting, where answering again needs one: an idempotency key that lets a retry replay the same answer instead of billing you twice (the key AnyAPI derives for MCP calls replays for five minutes), a connection that dropped after we paid a source (a retry can collect it for five minutes), and the result of a long-running request. Stored responses are compressed and encrypted with AES-GCM, kept in Azure storage apart from the database, and deleted by the storage service when their window ends. Responses over 5 MiB are not stored.

When a request fails at a source, we keep up to 256 KB of the failing response so we can diagnose it. That copy is encrypted with AES-GCM before it is written, is readable only through an internal path that records who read it, and is deleted 30 days after it was captured. The internal routing and cost records behind a request are deleted 90 days after it ran.

AnyAPI routes requests across underlying data providers and normalizes their schemas. Behind most endpoints the request goes to established providers such as Apify and ScrapeCreators under volume contracts, with smaller specialist sources behind automatic failover. The providers page lists every source and its traffic: direct data sources under their own brand, marketplace providers under stable pseudonyms.

An outbound call carries only the parameters that endpoint needs, rewritten into the source's own request shape, plus AnyAPI's credential for that source. Your account, your email address, your API key, and your IP address are not part of it. A source is billed by AnyAPI as one customer and cannot tell which of our customers a request came from.

Dashboard sign-in is handled by Clerk, using an email address and password or a Google account. Two-factor authentication, passkeys, and SAML single sign-on are not available today.

API requests are authenticated by an API key. A key is shown to you once, when you create it; we store only a SHA-256 hash of it, so nobody, including us, can read a key back out of our database. Each key can carry its own USD spend limit that resets daily, weekly, or monthly, and its own expiry date. You can rename, disable, or revoke a key in the dashboard; revoking is permanent, and a revoked key is refused on the next request.

Email support@getanyapi.com with steps to reproduce and we will work the issue with you. We do not run a paid bug bounty. Please test only against your own account, and do not access, alter, or retain another customer's data while investigating.