Compliance
A search data API that survives your data protection review
Most web-data procurement fails on one question: where did this come from, and can you put that in writing? This page is the answer we are willing to sign, including the parts that are not flattering.
The blocker is rarely technical
The evaluation that kills a web-data purchase is not the integration. It is the review that asks which sub-processors see the request, whether the data was obtained in a way the source permits, where inference runs, and what happens to the payload afterwards.
Answering those with a marketing page does not clear it. A reviewer needs artefacts: a data processing agreement, a documented retention period, a sub-processor list they can object to, and ideally something they can check themselves rather than take on trust.
- A vendor that rotates residential proxies cannot put its sourcing method in writing without describing the circumvention.
- Any model vendor in the path is another sub-processor, another transfer, another paragraph in your record of processing.
- Retention that is not written down is retention nobody can approve.
What we can put in writing
Step 1
Licensed sourcing, stated as a class
We buy access from licensed upstream providers. We do not scrape sources that forbid it, rotate residential proxies or solve CAPTCHAs, and any feature whose purpose is circumventing a site’s protections is out of scope regardless of demand.
Step 2
Inference stays in the EU
Synthesis runs on models we host ourselves. Your queries and the pages fetched to ground them are not sent to a third-party model vendor, so no model vendor joins your chain and no new international transfer is created by the analysis step.
Step 3
A receipt your reviewer can verify alone
Responses can carry a signed manifest: the class of the source, whether bot evasion was involved, where inference ran, and a SHA-256 of the exact payload. POST /v1/provenance/verify is public and needs no API key — the person who has to approve you does not have one.
The call, in full
curl https://api.dataswap.io/v1/provenance/public-key
curl -X POST https://api.dataswap.io/v1/provenance/verify \
-H "Content-Type: application/json" \
-d '{ "receipt": { }, "payload": { } }'No Authorization header: this is the point. Fetch the public key, check the signature, compare the hash.
The calls, and what they cost
| Endpoint | What it does | Price |
|---|---|---|
GET /v1/provenance/public-key | The Ed25519 public key used to sign receipts. | no key required, 0 credits |
POST /v1/provenance/verify | Check a receipt against a payload. Public and keyless. | no key required, 0 credits |
GET /v1/usage | What this key has spent, per operation — the record behind every invoice line. | 0 credits |
Compliance is not a plan tier here: licensed sourcing, EU inference and the receipt apply to every call on every plan, entry tier included. The data processing agreement is available from Starter upward because that is where a contract exists to attach it to.
1 credit = $0.002 on every plan. Full plans and prepaid packs are on the pricing section.
What we do not have
No SOC 2 and no ISO 27001. We are not certified by anyone, and the receipt is a signed self-attestation rather than a third-party audit. If your policy requires an audited certification, we do not meet it today and no amount of copy on this page changes that.
No contractual uptime SLA with service credits.
Multi-factor authentication for dashboard accounts is not available yet.
Some processing may still involve transfers outside the EEA, covered by an adequacy decision where one applies and otherwise by Standard Contractual Clauses. The EU-only claim is about inference, and we keep it that narrow on purpose.
Questions we get asked
- Do you sign a DPA?
- Yes, from the Starter plan upward. It sets out the Article 28 terms, the categories of sub-processors, international transfer mechanisms and the security measures, and the current text is published rather than sent on request.
- What exactly do you retain about my requests?
- A usage record per call — operation, credits, status and latency — kept for the life of the account because it is proof of what you were billed. Alongside it, for 30 days only, the truncated arguments you sent and the originating IP, so you can inspect a call in the dashboard. After 30 days both are erased. We do not store the responses we return to you.
- Who else sees my query?
- The licensed upstream provider that fulfils the data request receives the query parameters needed to serve it. Payment, transactional email and hosting providers are the other sub-processor categories, and a list naming each one is available before you sign.
- Does the receipt prove you complied with the law?
- No, and we say the same thing in the API response as we do here. It proves that we asserted a specific sourcing class and inference location for a specific payload, and signed that assertion. It is an auditable claim, not a certification.
- Is anything about this different on the entry plan?
- No. Sourcing, EU inference and receipts are properties of the system, not features of a tier. Only the signed DPA depends on there being a paid contract.
Keep reading
- Security practicesThe controls themselves: credentials, isolation, backups and what we do not claim.
- Data processing agreementThe Article 28 terms in full, including sub-processors and transfers.
- Dataswap vs SerpApiAn honest read of certification versus provenance, since SerpApi holds the certifications we do not.
- BlogNotes on how this is built and measured.
Put the prism to work.
Create an account and get your API key — no card required. Start on the six live bands and the twelve inference tools; the eight new capabilities land on the same key as they ship.