Security

Security Policy

How we protect the API, your data, and your API keys — and how to report a vulnerability.

Infrastructure

How we secure the API

Transport

All traffic between your application and api.law4devs.eu is encrypted using TLS 1.2 or higher. HTTP connections are automatically redirected to HTTPS. We do not support insecure connections.

Authentication

Access to the API is gated by unique API keys issued per account. Keys are never returned in API responses after creation. Losing a key requires immediate rotation via your dashboard.

Rate limiting

Per-key rate limits are enforced at the infrastructure level to mitigate abuse and protect availability. Limits apply regardless of the tier. Sustained anomalous usage triggers automatic investigation.

Infrastructure

The API is hosted on EU-based infrastructure. No data is processed or stored outside the European Union. We use industry-standard cloud providers with SOC 2 Type II certifications.

API Keys

Protecting your API key

Your API key is a credential equivalent to a password for your account. Treat it accordingly:

  • —Never commit an API key to a public repository. Use environment variables or a secrets manager.
  • —Never share your API key with third parties or include it in client-side code.
  • —Rotate your key immediately if you suspect it has been exposed.
  • —Report suspected compromise to [email protected] without delay.

We will never ask for your API key by email, Slack, or any other channel. If you receive such a request, report it to [email protected] immediately.

Responsible Disclosure

Reporting a vulnerability

We operate a responsible disclosure policy. If you discover a security vulnerability in the Law4Devs API, dashboard, or any other service we operate, we ask you to report it to us before disclosing it publicly.

How to report

Send a detailed report to [email protected]. Include a description of the vulnerability, reproduction steps, and the potential impact. We aim to acknowledge reports within 48 hours and resolve critical issues within 30 days.

We commit to not taking legal action against researchers who report vulnerabilities in good faith, provide reasonable time for remediation before publication, and do not access or modify data beyond what is necessary to demonstrate the issue.

Data

Data protection

The Law4Devs API does not require you to transmit personal data to query regulatory frameworks. Query parameters such as product type, sector, or company size are used solely to filter results and are not retained beyond the request lifecycle.

Account-level data (email address, billing information, API usage logs) is handled in accordance with our Privacy Policy. If you process personal data through your integration, our Data Processing Agreement is available for Pro and Scale tier customers.

Incident Response

How we handle incidents

In the event of a security incident affecting customer data or API availability, we will notify affected customers within 72 hours of becoming aware of the incident, in accordance with GDPR Article 33.

Notifications will be sent to the email address associated with your account. Ensure your account email is current and monitored. You can update it at any time from your dashboard.

For general security questions, contact [email protected].