Security

Last updated: January 3, 2026

API Key Security

Generation: API keys are cryptographically secure random tokens.

Storage: Keys are hashed using bcrypt before storage. We never store plain-text API keys.

Transmission: Always send your key via HTTPS in the Authorization header. Never include it in URLs.

Rotation: You can create new keys and delete old ones at any time from your dashboard.

Best Practices

  • - Never commit API keys to version control
  • - Store keys in environment variables, not in your code
  • - Use separate keys for development and production
  • - Revoke a key immediately if you think it was exposed

Data Protection & GDPR

RSI.TO is registered in Estonia (EU) and operates under GDPR. We take data minimization seriously - we only collect what is necessary to run the service.

  • - We collect your email address and usage data (API request counts, timestamps)
  • - We do not sell your data to third parties
  • - You can request full deletion of your account and data at any time from Settings
  • - In the event of a data breach we will notify affected users within 72 hours

Payments

All payments are processed by Stripe. We never see or store your card details - they go directly to Stripe's servers. Stripe is PCI DSS Level 1 certified, the highest level of payment security certification available.

Infrastructure

  • - All API traffic is served over HTTPS
  • - Rate limiting on all API endpoints
  • - API keys are never stored in plain text (bcrypt hashed)

Found a vulnerability?

If you discover a security issue, please email us at grailbitorg@gmail.com and we will respond promptly. We appreciate responsible disclosure and will credit reporters who help us improve.

Questions?

For any security concerns contact grailbitorg@gmail.com. For general support visit our Contact page.