Trust Center
fxapi is run by Everapi GmbH, a company under Austrian law, so the GDPR applies to everything we do. The API, the dashboard and the databases run on our own servers in Germany. This page shows how we protect the data you send us: what is in place today, where the data is kept and who processes it for us.
- Servers in GermanyOur own dedicated servers at Hetzner
- TLS end to endFrom you to Cloudflare to our servers and between them
- Encrypted backupsEncrypted before they leave our servers
- GDPRAustrian company, EU data protection law
Security
Encryption
- Encrypted in transit, end to endHTTPS between you and Cloudflare. Cloudflare connects to our servers over TLS and checks their certificate (Full strict). Our own servers talk to the databases, the cache and the log store over TLS as well.
- Encrypted backupsDatabase backups are encrypted on our servers before they leave them. The backup provider stores only encrypted copies and has no key.
- Card data never reaches usPayments go through Stripe. Card numbers are entered at Stripe and never touch our servers.
Your account
- Two-factor authenticationProtect your sign-in with an authenticator app, confirmed with a code when you turn it on, and recovery codes for when you lose your phone. It also applies when you sign in with Google, GitHub, GitLab or Microsoft.
- Require 2FA for your teamOwners and admins can require two-factor authentication for every member of their team. Members without it are walked through the setup before they can continue.
- Sign-in protectionSign-in attempts are rate limited, and an account is locked for a while after repeated failed attempts. Passwords known from data breaches are refused. New accounts must verify their email address.
- New sign-in alertsWhen someone signs in to your account from a browser we have not seen before, we email you the time, browser and approximate location.
- Sessions you controlSee where you are signed in and sign out all other sessions from your profile. Sessions end after 7 days.
- Audit trailOn paid plans, the dashboard shows sign-ins, failed sign-ins, password and 2FA changes, team member changes, API key changes, plan and billing changes, with time and IP address. Export it as CSV. Entries are kept for 2 years.
- Support access is visibleIf our support team opens your account to help you, the audit trail shows when the access started and ended, and every change made during it is marked as made by Everapi support.
- Signed webhooksEvery webhook we send carries an HMAC-SHA256 signature over a timestamp and the body. You can rotate the secret without downtime, and we store it encrypted.
- Delete your account yourselfDelete your account from the dashboard at any time. Your teams, API keys, subscriptions, webhooks and search history go with it; invoices are kept for 7 years as Austrian tax law requires.
Infrastructure
- Own servers in GermanyThe API, the dashboard and the databases run on dedicated servers we rent from Hetzner in data centers in Germany.
- Firewall and DDoS protectionCloudflare filters traffic before it reaches us (WAF, DDoS protection, bot checks). Every server runs its own firewall; databases and internal services accept connections only from our own servers.
- Staff access requires 2FAEveryone at Everapi who can use our admin tools or open a customer account for support must sign in with two-factor authentication.
- Servers set up from codeServer configuration lives in our repository (Ansible). Every change is recorded in version control.
- Backups kept apartBackups go to a separate provider in another country, so a problem with our servers or with Cloudflare does not touch them. They are kept for 14 days.
Monitoring
- Public status pageAn independent monitor checks the API every minute and publishes the results.
- Error tracking and metricsErrors go to Sentry. Server and API metrics are collected around the clock.
- Central logs with limited retentionRequest logs are collected in one place. The personal fields in them (request URL, IP address, user agent) are deleted after 90 days.
Data protection
- GDPR, Austrian companyEverapi GmbH is a company under Austrian law, and the GDPR applies to everything we do. The supervisory authority is the Austrian Datenschutzbehörde.
- Public list of sub-processorsEvery provider that processes personal data for us is listed, with what it receives and where. We announce new ones at least 30 days ahead.
- Short retentionWeb server logs are deleted after about 14 days, personal fields in request logs after 90 days, backups after 14 days. Details are in the privacy policy.
- No selling of data, no model trainingWe do not sell what you send to the API. The AI provider that helps us answer support emails does not train on them.
- SPF, DKIM and DMARCEvery product domain publishes SPF and a DMARC policy that quarantines mail failing the checks. Account emails are signed with DKIM.
Disclosure
- security.txt on every siteSecurity researchers find our contact at /.well-known/security.txt. We answer reports to office@everapi.com.
- Dependencies checked on every changeEvery change to our code runs automated checks of its PHP and JavaScript dependencies against known security advisories.
- Regular security reviewsWe review our code, dependencies and servers for security problems several times a year; the last review was in October 2026.
Where your data is
The API and the dashboard run on our own servers in Germany. Requests reach them through Cloudflare, which handles each request in one of its data centers, usually one near the caller; that data center can be outside the EU.
| Data | Where |
|---|---|
| Account data, usage data and request logs | Our servers in Germany (Hetzner) |
| Files you store with us, cached free tool answers and website pages | Cloudflare (R2 storage and global network) |
| Backups of our main database, encrypted | Backblaze, Netherlands (Amsterdam) |
| Details of failed requests (error tracking) | Sentry, United States |
| Website and dashboard analytics | PostHog, EU |
| Payments and invoices | Stripe, Ireland and United States |
| Support emails | Google Workspace, Ireland and United States |
Our status page checks the API every minute. How long we keep each kind of data is in our privacy policy.
Sub-processors
These service providers process personal data on our behalf when we provide the fxapi API and the dashboard at app.fxapi.com. Last updated: 28 October 2026.
| Provider | What it does for us | Personal data it may receive | Location |
|---|---|---|---|
| Hetzner Online GmbH | Servers for the API, the dashboard, our databases and our logs | All data described in our privacy policy, including what you send to the API | Germany |
| Cloudflare, Inc. | DNS, network proxy, encryption (TLS) and firewall for the API and the dashboard; hosting of this website and the free tools; bot protection (Turnstile); file storage (R2); delivery of contact form messages | Every request while it passes through, including what you send to the API; files stored for you; free tool lookups (cached for up to 7 days); contact form messages | United States, global network |
| Functional Software, Inc. (Sentry) | Error tracking for the API and the dashboard | Details of requests that caused an error | United States |
| PostHog, Inc. | Analytics for this website and the dashboard; recordings of dashboard sessions | Usage data and page addresses; in the dashboard, events linked to your account | EU (Germany) |
| Stripe | Payments and invoices | Billing details; card data goes to Stripe directly and never reaches our servers | Ireland, United States |
| Postmark (ActiveCampaign, LLC) | Sending account emails | Your email address and the content of the email | United States |
| Google (Google Workspace) | Our email, including support requests and contact form messages | Your messages and contact details | Ireland, United States |
| Anthropic, PBC | AI-assisted drafting of replies to support requests | Your message, its attachments and the account details needed to answer; not used to train models | United States |
| Slack (Salesforce, Inc.) | Internal notifications to our team | Account name, email address and summaries of support requests | United States |
| Backblaze, Inc. | Backups of our main database, encrypted on our servers before upload, kept for 14 days | Encrypted copies of our main database, including account data; Backblaze cannot read them | Netherlands (Amsterdam) |
We tell the account owner by email at least 30 days before a new sub-processor starts to process personal data. If you object for a reason related to data protection, you can end the affected service before the change; we refund fees you paid in advance for the time after it.
Download this list as CSV. Providers that only serve this website, such as font hosting, and the sign-in providers you can choose are named in our privacy policy.
Documents
- Privacy policyWhat we collect, why, for how long, and your rights
- Terms of serviceThe agreement for using the service
- Sub-processorsWho processes personal data for us, and where
- HostingWhere the service runs and where data is kept
- ImprintCompany details
- Sub-processors (CSV)The same list as a spreadsheet
- security.txtHow to report a security problem
Questions
Is fxapi GDPR compliant?
We process your data in line with the GDPR. fxapi is run by Everapi GmbH, a company under Austrian law, so the GDPR applies to everything we do; the supervisory authority is the Austrian Datenschutzbehörde. The API, the dashboard and the databases run on our own servers in Germany, and every provider that processes personal data for us is on our public list of sub-processors.
Is fxapi SOC 2 or ISO 27001 certified?
No. fxapi has no SOC 2 report and no ISO 27001 certificate. This page lists the security measures that are in place today, where your data is kept and every sub-processor, and we review our code, dependencies and servers for security problems several times a year.
Where does fxapi store my data?
Account data, usage data and request logs are kept on our own servers in Germany (Hetzner). Requests reach them through Cloudflare, which handles each one in a data center usually near the caller, and Cloudflare's storage (R2) keeps the files you store with us. Encrypted backups of our main database are kept at Backblaze in Amsterdam, Netherlands.
Is my data encrypted?
In transit, end to end: HTTPS between you and Cloudflare, TLS with a checked certificate from Cloudflare to our servers, and TLS between our servers, databases, cache and log store. Database backups are encrypted on our servers before they leave them, and the backup provider has no key. Card numbers are entered at Stripe and never reach our servers.
Does fxapi support two-factor authentication?
Yes. You can protect your sign-in with an authenticator app and recovery codes, also when you sign in with Google, GitHub, GitLab or Microsoft. Owners and admins can require two-factor authentication for every member of their team.
How long does fxapi keep my data?
Web server logs are deleted after about 14 days, the personal fields in request logs (request URL, IP address, user agent) after 90 days, and backups after 14 days. You can delete your account yourself at any time: your teams, API keys, subscriptions, webhooks and search history go with it, and invoices are kept for 7 years, as Austrian tax law requires.
Does fxapi sell my data or use it to train AI models?
No. We do not sell what you send to the API. The AI provider that helps us draft replies to support emails does not train on them.
How do I report a security problem?
Write to office@everapi.com. Security researchers also find this contact in /.well-known/security.txt on every one of our sites.