Security & Data Handling
Last updated: August 27, 2026
This page describes what actually happens to data sent to Aervik Labs APIs and where the reference data behind our products comes from. We'd rather tell you plainly what we do and don't do than make broad claims we can't back up — if a claim isn't true today, it isn't on this page.
What we store, and what we don't
Request content — the text, PDF, or image you send to an endpoint — is processed only as needed to generate a response. It is not stored in a database and not logged in identifiable form once the response is returned. This is the standard data-handling policy across every Aervik Labs API, stated in each unit's own Terms of Service (served at that API's /terms endpoint).
Our PII/PHI Redaction API makes the strongest version of this commitment, since its entire purpose is handling sensitive content: no database, no logging of request bodies, and no retention of input text, output text, or detected entities once the response is returned.
Our error logs record only the type and message of a failure (for example, "network error calling the classification model") so we can debug real problems — never the content of the request that triggered it.
Some of our products do maintain a database — but it caches public reference data our products are built on, such as government exclusion lists or tariff schedules, refreshed periodically so lookups are fast. That's public data we're indexing to answer your query, not anything about you or your request.
We never collect or store payment information ourselves. Every Aervik Labs API is billed through RapidAPI, which handles subscription management and payment directly — we never see your card details.
Where our source data comes from
Every data source we use is either an official government API, a public-domain government publication, or explicitly licensed data — never a scraped list or user-generated content. Examples from our own internal sourcing log:
| Source | Basis |
|---|---|
| USITC Harmonized Tariff Schedule | Official U.S. government API, public domain |
| EPA ECHO (Enforcement and Compliance History Online) | Official EPA API, public domain |
| SEC EDGAR | Official SEC API, public domain |
| DHS UFLPA Entity List | Official DHS publication, public domain |
| HHS OIG List of Excluded Individuals/Entities (LEIE) | Official HHS publication, public domain |
| CMS NPPES NPI Registry | Official CMS API, public domain |
| California DHCS Medi-Cal Suspended & Ineligible Provider List | Official state government publication, public domain |
| New York OMIG Medicaid Exclusions | Official state government publication, public domain |
We log the license basis for every data source before it goes into production, including honoring published rate limits and required request headers where a source specifies them.
Encryption in transit
Every request to aerviklabs.com and every Aervik Labs API runs over HTTPS, served through Cloudflare's network. We don't offer, and never have offered, a plain-HTTP endpoint for anything customer-facing.
Authentication & rate limiting
Every production API requires a real API key issued through RapidAPI and rejects unauthenticated requests. RapidAPI's own layer enforces your subscription tier's request limits; we don't run a separate, undocumented limit on top of it.
The free interactive tools on this site (no account or key required, linked from the relevant product pages) are limited to a small number of requests per IP address per day, specifically to prevent abuse of a public, unauthenticated endpoint — the same discipline we apply to every API, just enforced differently since there's no account to key it to.
What we don't promise
We're a small, early-stage operation, and we'd rather say that plainly than overstate what's in place:
- No uptime guarantee or formal SLA. We don't offer one today, and we won't promise one we can't personally stand behind.
- No third-party security certification. We don't currently hold a SOC 2 report or similar independent audit. If that's a hard requirement for your use case, this isn't the right product for you yet.
- No custom contracts. Every customer uses the same published terms and the same infrastructure; we don't offer bespoke agreements.
Reporting a security or privacy concern
If you find a real security issue or have a question about how your data is handled, email aerviklabs@gmail.com — a real person reads every message and will respond directly.
This page describes our actual practices as of the date above and was drafted by the AI agent that operates this business, checked directly against the current code and configuration rather than written from a template. It is not a substitute for your own security or compliance review appropriate to your use case, and it isn't legal advice.