Check us the way
we ask you to check anyone.
Most trust pages are a list of promises and a badge. Every line on this one carries a mark: checkable, meaning it links to something you can verify without trusting us; our word, meaning it is a statement about our own systems; or not held.
Checkable Our word Not held
Ed25519
Every passport signed
RFC 3161
Outside timestamps, nightly
TLS 1.2+
In transit, 1.3 offered
None held
SOC 2, ISO 27001, pen test
Last updated 28 September 2026
What we hold: nothing, yet
A small company should say this plainly. When an audit is engaged, this section will name the auditor and the date. Until then, the rest of this page is built so you need neither.
What you can verify without us
The part no badge can give you. Each of these opens the real thing, and none of them asks you to trust APIR.
A passport, with its chain
CheckableThe Originator’s papers: the signature, and the Black Box chain behind it recomputed from stored content, as of the reading shown on the page.
A checker that runs unplugged
CheckableOne page, no network requests allowed by its own security policy. Drop a proof and a file into it and check a seal with APIR switched off.
Every public passport
CheckableThe radar re-verifies each public passport’s signature against the published key on every reading.
Encryption in transit
CheckableTLS 1.2 is the minimum on apir.ai and 1.3 is offered. Anyone can confirm it: openssl s_client -connect apir.ai:443.
How the platform is built
Statements about our own systems. They are true as of the date on this page, and they are ours: a reviewer who needs more can ask, and a person answers.
Row-level security on every table
Our wordRow-level security is switched on for every table in the database, and none is exempt. Measured 28 September 2026.
Signing keys that never leave the vault
Our wordPrivate signing keys are generated inside the edge runtime, sealed in Supabase Vault, and never exported.
Encrypted at rest
Our wordAES-256, applied by our database provider to the storage underneath.
No secret in the browser
Our wordNo secret in the repository or the client bundle; the only key a browser sees is the public one it needs. The service-role key stays on the server.
One administrator
Our wordPlatform administration is one fixed identity, gated on the server as well as hidden in the interface. There is no role that grants it to anyone else.
Two-factor sign-in
Our wordTOTP two-factor is available in account settings.
Rate limits on the free checks
Our wordThe free, no-account checks are limited per caller. On since 28 September 2026.
Gated change
Our wordProduction deploys only from a build that passes its typecheck. Lint and tests run on every push.
What happens to what you give us
We train no models
Our wordAPIR trains no model, on your data or anyone’s. It calls models through their providers’ APIs.
Where a model call goes
Our wordTo Anthropic directly first. If that fails, through OpenRouter to another provider, with an open-weight model as the last resort. Web-grounded search and some bulk work go to Google’s Gemini API.
An agent stages; a person sends
Our wordNo agent emails, posts, signs, lodges or charges on its own. A database trigger refuses any draft marked approved or sent with no human reviewer recorded, whoever the caller.
Your file stays with you
CheckableChecking a file against the seal record, and the Numbers Check, fingerprint the file in your browser. The bytes are never sent. Watch the network tab.
Who else touches your data
Every service that processes data for APIR, what it does, and where. Current as of 28 September 2026.
| Subprocessor | Purpose |
|---|---|
| Supabase | Database, auth, storage, edge functions |
| Cloudflare | Hosting, CDN, edge runtime, rate limits |
| Stripe | Payments and billing |
| Anthropic | Model calls (Claude) |
| OpenRouter | Fallback model routing to other providers |
| Gemini API (search, bulk work), Places (business lookups) | |
| Resend | |
| PostHog | Product analytics |
| freeTSA | RFC 3161 timestamps; receives a hash, never content |