Security and Data Handling
Gateway boundary
pseudonymize.io is a hosted gateway for a separate Python pseudonymization engine. The gateway authenticates API keys, validates requests, reserves credits, forwards payloads, and settles or refunds reservations. The public endpoint uses HTTPS. The engine endpoint is deployment configuration; this repository alone does not establish its transport security, location, logging, or storage controls.
Credentials and operational records
API key records store SHA-256 hashes and non-secret prefixes rather than raw bearer secrets. Account authentication, billing, usage, and reservation metadata are stored in PostgreSQL. Structured gateway request metrics exclude request and response bodies. Unexpected gateway exceptions are logged using a fixed diagnostic message rather than the exception object. Avoid personal data in client-supplied identifiers and configuration fields.
Payload lifecycle
Submitted text and JSON enter gateway process memory and are forwarded to the Python engine. Successful responses with an Idempotency-Key remain in memory for a five-minute replay window. Response entity details may include original identifiers. Expired responses cannot be replayed; references are removed on access or by a cleanup sweep every minute. Process restarts also lose the cache. This is transient retention, not immediate erasure after the response.
The gateway does not put API bodies in its billing tables. An end-to-end zero-disk guarantee would also require verified engine, proxy, swap, crash-dump, logging, and backup controls. Such a guarantee is not established here.
Infrastructure and providers
The gateway and account database run on Hetzner Cloud in Nuremberg, Germany. Cloudflare handles public edge traffic. The Python engine is a separate configured service. Confirm its current hosting and processing region before relying on a residency requirement. Stripe, Resend, and optional Google sign-in process payment, email, or authentication data. Browser analytics through PostHog is disabled.
See the Privacy Policy for metadata retention and account deletion limits. No certification, exclusive EU processing, specific response SLA, or benchmark score is asserted by this page.
Limits of pseudonymization
Pseudonymization reduces exposure; it does not make data anonymous. Detection can miss identifiers, and contextual information can still identify people. Inspect the engine response and entity details before forwarding data downstream. You remain responsible for deciding whether transformed data is appropriate for the intended use.
Contact
Report security issues to [email protected]. For technical support contact [email protected]; for privacy and processing agreements contact [email protected].