Trust Center

freeiplookupapi is run by Everapi GmbH, a company under Austrian law. This page shows how we protect the data you send us: what is in place today, where the data is kept and who processes it for us.

Last reviewed: 28 October 2026

  • Servers in GermanyOur own dedicated servers at Hetzner
  • TLS end to endFrom you to Cloudflare to our servers and between them
  • Encrypted backupsEncrypted before they leave our servers
  • GDPRAustrian company, EU data protection law

Security

Encryption

  • Encrypted in transit, end to endHTTPS between you and Cloudflare. Cloudflare connects to our servers over TLS and checks their certificate (Full strict). Our own servers talk to the databases, the cache and the log store over TLS as well.
  • Encrypted backupsDatabase backups are encrypted on our servers before they leave them. The backup provider stores only encrypted copies and has no key.
  • Card data never reaches usPayments go through Stripe. Card numbers are entered at Stripe and never touch our servers.

Your account

  • Two-factor authenticationProtect your sign-in with an authenticator app, confirmed with a code when you turn it on, and recovery codes for when you lose your phone. It also applies when you sign in with Google, GitHub, GitLab or Microsoft.
  • Require 2FA for your teamOwners and admins can require two-factor authentication for every member of their team. Members without it are walked through the setup before they can continue.
  • Sign-in protectionSign-in attempts are rate limited, and an account is locked for a while after repeated failed attempts. Passwords known from data breaches are refused. New accounts must verify their email address.
  • New sign-in alertsWhen someone signs in to your account from a browser we have not seen before, we email you the time, browser and approximate location.
  • Sessions you controlSee where you are signed in and sign out all other sessions from your profile. Sessions end after 7 days.
  • Audit trailOn paid plans, the dashboard shows sign-ins, failed sign-ins, password and 2FA changes, team member changes, API key changes, plan and billing changes, with time and IP address. Export it as CSV. Entries are kept for 2 years.
  • Support access is visibleIf our support team opens your account to help you, the audit trail shows when the access started and ended, and every change made during it is marked as made by Everapi support.
  • Signed webhooksEvery webhook we send carries an HMAC-SHA256 signature over a timestamp and the body. You can rotate the secret without downtime, and we store it encrypted.
  • Delete your account yourselfDelete your account from the dashboard at any time. Your teams, API keys, subscriptions, webhooks and search history go with it; invoices are kept for 7 years as Austrian tax law requires.

Infrastructure

  • Own servers in GermanyThe API, the dashboard and the databases run on dedicated servers we rent from Hetzner in data centers in Germany.
  • Firewall and DDoS protectionCloudflare filters traffic before it reaches us (WAF, DDoS protection, bot checks). Every server runs its own firewall; databases and internal services accept connections only from our own servers.
  • Servers set up from codeServer configuration lives in our repository (Ansible). Every change is recorded in version control.
  • Backups kept apartBackups go to a separate provider in another country, so a problem with our servers or with Cloudflare does not touch them. They are kept for 14 days.

Monitoring

  • Public status pageAn independent monitor checks the API every minute and publishes the results.
  • Error tracking and metricsErrors go to Sentry. Server and API metrics are collected around the clock.
  • Central logs with limited retentionRequest logs are collected in one place. The personal fields in them (request URL, IP address, user agent) are deleted after 90 days.

Data protection

  • GDPR, Austrian companyEverapi GmbH is a company under Austrian law, and the GDPR applies to everything we do. The supervisory authority is the Austrian Datenschutzbehörde.
  • Public list of sub-processorsEvery provider that processes personal data for us is listed, with what it receives and where. We announce new ones at least 30 days ahead.
  • Short retentionWeb server logs are deleted after about 14 days, personal fields in request logs after 90 days, backups after 14 days. Details are in the privacy policy.
  • No selling of data, no model trainingWe do not sell what you send to the API. The AI provider that helps us answer support emails does not train on them.

Email

  • SPF, DKIM and DMARCEvery product domain publishes SPF and a DMARC policy that quarantines mail failing the checks. Account emails are signed with DKIM.

Disclosure

  • security.txt on every siteSecurity researchers find our contact at /.well-known/security.txt. We answer reports to office@everapi.com.
  • Dependencies checked on every changeEvery change to our code runs automated checks of its PHP and JavaScript dependencies against known security advisories.
  • Regular security reviewsWe review our code, dependencies and servers for security problems several times a year; the last review was in October 2026.

Where your data is

The API and the dashboard run on our own servers in Germany. Requests reach them through Cloudflare, which handles each request in one of its data centers, usually one near the caller; that data center can be outside the EU.

DataWhere
Account data, usage data and request logsOur servers in Germany (Hetzner)
Files you store with us, cached free tool answers and website pagesCloudflare (R2 storage and global network)
Backups of our main database, encryptedBackblaze, Netherlands (Amsterdam)
Details of failed requests (error tracking)Sentry, United States
Website and dashboard analyticsPostHog, EU
Payments and invoicesStripe, Ireland and United States
Support emailsGoogle Workspace, Ireland and United States

Our status page checks the API every minute. How long we keep each kind of data is in our privacy policy.

Sub-processors

These service providers process personal data on our behalf when we provide the freeiplookupapi API and the dashboard at app.freeiplookupapi.com. Last updated: 28 October 2026.

ProviderWhat it does for usPersonal data it may receiveLocation
Hetzner Online GmbHServers for the API, the dashboard, our databases and our logsAll data described in our privacy policy, including what you send to the APIGermany
Cloudflare, Inc.DNS, network proxy, encryption (TLS) and firewall for the API and the dashboard; hosting of this website and the free tools; bot protection (Turnstile); file storage (R2); delivery of contact form messagesEvery request while it passes through, including what you send to the API; files stored for you; free tool lookups (cached for up to 7 days); contact form messagesUnited States, global network
Functional Software, Inc. (Sentry)Error tracking for the API and the dashboardDetails of requests that caused an errorUnited States
PostHog, Inc.Analytics for this website and the dashboard; recordings of dashboard sessionsUsage data and page addresses; in the dashboard, events linked to your accountEU (Germany)
StripePayments and invoicesBilling details; card data goes to Stripe directly and never reaches our serversIreland, United States
Postmark (ActiveCampaign, LLC)Sending account emailsYour email address and the content of the emailUnited States
Google (Google Workspace)Our email, including support requests and contact form messagesYour messages and contact detailsIreland, United States
Anthropic, PBCAI-assisted drafting of replies to support requestsYour message, its attachments and the account details needed to answer; not used to train modelsUnited States
Slack (Salesforce, Inc.)Internal notifications to our teamAccount name, email address and summaries of support requestsUnited States
Backblaze, Inc.Backups of our main database, encrypted on our servers before upload, kept for 14 daysEncrypted copies of our main database, including account data; Backblaze cannot read themNetherlands (Amsterdam)

We tell the account owner by email at least 30 days before a new sub-processor starts to process personal data. If you object for a reason related to data protection, you can end the affected service before the change; we refund fees you paid in advance for the time after it.

Download this list as CSV. Providers that only serve this website, such as font hosting, and the sign-in providers you can choose are named in our privacy policy.

Documents