Fileverity API docs
Data retention and security
What the Fileverity API stores and for how long: uploaded files, results, text, request logs and webhook deliveries, and how keys and endpoints are protected.
View as MarkdownUpdated 2026-11-04
This page lists what the API keeps and for how long. For the wider picture, see Trust and security.
Retention
| Data | Kept | Notes |
|---|---|---|
| Uploaded files | Deleted when an analysis starts, and at the latest after 24 hours | Stored privately. DELETE /files/{id} removes a file sooner. |
Text you send to POST /text/detections | Not stored | Evaluated and discarded. It is never stored, so it cannot be retrieved later. |
| Text detection results (never the text) | 7 days | Verdict, scores, passage offsets and usage. Shown in Past checks in the Console. Test keys record nothing. |
| Analysis results | 7 days | Then the result is removed. The verification record of the report remains available. |
| Document evidence (page images, text excerpts) | 3 hours | Download the PDF report before then to keep the evidence in it. |
| Request logs | 30 days | Method, path, status, duration, error code and key. Not request or response bodies. |
| Webhook delivery logs | 30 days | The event payload, status, response time and the first 2 KB of your endpoint's response. The latest 50 are shown in the Console. |
| Idempotency records | 24 hours | The saved response, used to replay a retried request. For text detections it is the result without the text. |
Protection
- HTTPS only. All API traffic uses HTTPS.
- Keys. Only a SHA-256 hash and the last four characters of a key are stored. Keys can be revoked at any time. See Authentication and keys.
- Workspace isolation. Files, analyses, keys, webhooks and logs belong to one workspace and one mode; live and test keys cannot read each other's files.
- Spend limits. Per-key monthly limits cap what a leaked key can spend.
- Webhooks. Deliveries are signed with a per-endpoint secret. Endpoints must use HTTPS and public addresses; private and internal addresses are refused. Redirects are not followed.
- Verifiable reports. Image and document reports carry a report ID, SHA-256 fingerprints and an RFC 3161 timestamp, and have a public verification page.
Enterprise
Private deployment is available to Enterprise customers on request. Contact us to discuss it.
Legal
See the Privacy policy, the Terms of service and the Data processing agreement.