Security and trust

AnyAPI is prepaid. You add funds to a USD wallet and each request is charged against your balance at the per-request price shown in the catalog.

Top-ups are collected on Stripe's hosted checkout page, and Autumn is our billing provider. Card details are typed into Stripe's page, not ours, so no card number ever reaches an AnyAPI server. We do not store card numbers, expiry dates, security codes, or the last four digits. What we keep is Stripe's identifier for the payment, the amount in USD, and the timestamp.

AnyAPI holds no security certification. We are not SOC 2 audited, ISO 27001 certified, or independently penetration tested, and this page is the whole of what we claim.

Because collection happens on Stripe's own page, the gateway only ever handles Stripe's tokens: the identifier of the payment and, if you save a card, the identifier of the saved payment method. Those identifiers are useless outside our Stripe account.

Automatic top-ups are off unless you turn them on. When they are on, our billing provider charges the saved payment method without you present, and you can switch automatic top-ups off or change the amount in the dashboard at any time.

Stripe tells us a payment completed over a webhook. Every webhook payload is checked against our endpoint signing secret before the wallet moves, and a payload that fails the check, or arrives when no signing secret is configured, is rejected.

You decide what the Service retrieves; we act on your instructions. Traffic to getanyapi.com and to the gateway at api.getanyapi.com is served over HTTPS. The website runs on Cloudflare. The gateway runs on our own server in Microsoft Azure in the United States, and its database runs on a separate machine on a private network with no port open to the internet.

We keep one record per request: the endpoint you called, the parameters you sent, the response status, how long it took, the amount charged, and which API key made the call.

We do not keep the response body. Two narrow exceptions store it, and both expire. If you send an idempotency key so that a retry returns the same answer instead of billing you twice, the response is held for 24 hours; the key AnyAPI derives for MCP calls holds it for five minutes. If your connection drops mid-request, the answer you already paid for is held for five minutes so a retry can collect it. When the window ends, the stored response is erased from the record.

When a request fails at a source, we keep up to 256 KB of the failing response so we can diagnose it. That copy is encrypted with AES-GCM before it is written, is readable only through an internal path that records who read it, and is deleted 30 days after it was captured. The internal routing and cost records behind a request are deleted 90 days after it ran.

AnyAPI routes requests across underlying data providers and normalizes their schemas. Behind most endpoints the request goes to established providers such as Apify and ScrapeCreators under volume contracts, with smaller specialist sources behind automatic failover. The providers page lists every source and its traffic: direct data sources under their own brand, marketplace providers under stable pseudonyms.

An outbound call carries only the parameters that endpoint needs, rewritten into the source's own request shape, plus AnyAPI's credential for that source. Your account, your email address, your API key, and your IP address are not part of it. A source is billed by AnyAPI as one customer and cannot tell which of our customers a request came from.

Dashboard sign-in is handled by Clerk, using an email address and password or a Google account. Two-factor authentication, passkeys, and SAML single sign-on are not available today.

API requests are authenticated by an API key. A key is shown to you once, when you create it; we store only a SHA-256 hash of it, so nobody, including us, can read a key back out of our database. Each key can carry its own USD spend limit that resets daily, weekly, or monthly, and its own expiry date. You can rename, disable, or revoke a key in the dashboard; revoking is permanent, and a revoked key is refused on the next request.

Email support@getanyapi.com with steps to reproduce and we will work the issue with you. We do not run a paid bug bounty. Please test only against your own account, and do not access, alter, or retain another customer's data while investigating.