Security & Data Handling

Data sources & provenance

Verification results derive from official government sources: state licensing board roster files and board websites. We do not invent, infer, or blend data from unofficial sources.

Every API response includes a provenance block so you can trace exactly where a result came from: the source board, the method used (roster file, board website, or cross-reference), the date the underlying data is current as of (data_as_of), and when we retrieved it (retrieved_at).

API security

• API keys (sk_live_*) are stored as SHA-256 hashes. The full key is shown exactly once at creation and cannot be retrieved afterwards - only revoked and replaced.
• All traffic is served over TLS. There is no plaintext HTTP endpoint.
• Each API key has its own rate limits, reported back via response headers.
• The customer dashboard uses JWT authentication with refresh-token rotation: refresh tokens are single-use, and detected reuse revokes the whole token family.

Webhook security

• Webhooks carry X-Webhook-Timestamp and X-Webhook-Signature, an HMAC over ${timestamp}.${body}, so you can verify both authenticity and freshness.
• Each webhook endpoint has its own whsec_ signing secret, shown once at creation.
• Secrets can be rotated at any time via a dedicated rotation endpoint.
• Endpoints that fail repeatedly are disabled automatically so we never hammer a broken receiver.

Audit trail

Every verification request is recorded in an append-only log with its result, source, latency, and timestamp. This is the same record we use for billing reconciliation, so what you are charged for is exactly what was logged. Your usage history is exportable via the API at any time.

Data handling

• We store the license numbers you query and the public-record verification results they return.
• We never ask for Social Security numbers. A date of birth is optional on exclusion screening, where it is used only to strengthen a name match within that request - it is not written to your usage log and is not stored against your account.
• Our roster mirrors contain only data that state licensing boards have publicly published.