Searlo

Security

Security controls

The controls that protect your account, your API keys and your data, described as they run today.

Start free — 3,000 creditsView pricing

Controls in place

  • Encryption in Transit

    All traffic is served over HTTPS through Cloudflare, with HSTS enabled.

  • Hashed, Scoped API Keys

    Keys are generated from 32 random bytes and stored only as SHA-256 hashes, so the full key is shown once, when you create it. A key can call the data API and read its own account's balance, usage and profile. It cannot manage the account: keys, billing, data export and account deletion need a dashboard sign-in, and the admin area never accepts a key. Each key has its own name and rate limit, and can be revoked at any time.

  • Passwords and Sessions

    Sign in with an email and password, or with an OAuth 2.0 provider. Passwords are stored only as bcrypt hashes, and sessions are signed JWTs (HS256). Changing your password ends every session signed in before the change.

  • Logged Admin Actions

    Every change made through the admin panel (account role and status, credit grants and deductions, rate-limit overrides, support approvals) is recorded with who made it, when, and from which IP address. Every API request is recorded against its account, and every credit change in a ledger.

  • Encrypted Off-site Backups

    The database is backed up every day, and changes are captured every 15 minutes, to Backblaze B2. Backups are encrypted on our server before upload (restic, AES-256), so the storage provider cannot read them. A full restore has been tested.

  • Payments by Paddle

    Paddle is our merchant of record. Card numbers are entered in Paddle's checkout and never reach Searlo's servers.

  • Limited Production Access

    Access to production servers and data is limited to the founder, over authenticated connections.

  • Data Isolation

    Every key, request record and billing record is tied to the account it belongs to, and the dashboard and API return an account's own data only.

  • Monitoring and Recovery

    Every API family is checked once a minute from a separate server; the record is public at status.searlo.tech. A written disaster-recovery runbook covers restoring the database from backup.

Your Data

  • We never sell your data to third parties
  • Search query history is kept for up to 10 years, then deleted automatically; you can delete entries or clear it yourself at any time
  • You can export your data, or delete your account, from the dashboard
  • Search results are cached briefly (an hour on most endpoints, up to a day on a few) to answer repeat requests
  • Submitter IP addresses are pseudonymized; query strings are stored linked to the submitting account only

Data Processing & Storage

Searlo runs on several dedicated servers at Contabo in France (EU), with Cloudflare in front for DNS, CDN and DDoS mitigation. The database is self-hosted MongoDB and the cache is self-hosted Redis.

Engineering and support are provided by the sole founder, located in Bangladesh.

Data Retention

How long each kind of data is kept:

  • API logs (your account's request history): up to 10 years, unless you delete them; you can delete single entries or clear your history from the dashboard
  • Usage totals (daily, per account): for the life of the account
  • Billing records: As required by law
  • Account data: Until deletion requested

Sub-processors

Third-party services that may process your data on our behalf.
VendorPurposeData ProcessedRegion
PaddlePayment processing (merchant of record)Billing infoUnited Kingdom / EU
Contabo GmbHServer hosting (database, application, search serving, status page)All service dataEU (France)
CloudflareCDN, DDoS protection, DNSRequest metadata, IPsGlobal (nearest edge)
BackblazeOff-site database backupsDatabase backups, encrypted before uploadUnited States
PostHogProduct analyticsWebsite usage events (pageviews, clicks) and, where enabled, session recordingsUnited States

Incident Response

Report a security issue to [email protected]. If an incident affects your data, we will notify you as required by applicable law.

Questions about security?

For security disclosures or vendor questionnaires, write to [email protected].

Related Pages