Security

How ParseAPI handles encryption, keys, payments, and your data.

Last updated: September 5, 2026

On this page 7 sections

Encryption

  • Connections to the website and API are encrypted over HTTPS.
  • Use HTTPS for every API call, including the first request.

Sign-in

  • Sign-in is passwordless. A magic link goes to your email and expires in 24 hours.
  • There is no password database.

API keys

  • Keep secret keys on your server, out of browser code, mobile apps, and public repositories.
  • Public keys go in browser code. Requests are checked against the domains configured on the key.
  • App keys ship in mobile apps. The app ID sent with each request must match the key's list.
  • Archive a key anytime from the dashboard. Archived keys stop working.
  • Team members can view ordinary API keys. Keys managed for connected apps are not revealed.
  • Creating, editing, and archiving keys requires an owner or admin role.

Domain and app ID checks rely on request headers that software can supply or imitate. They do not authenticate a person or prove that an app is genuine. Keep sensitive operations on your server. Public keys can consume metered allowances and enabled on-demand spending.

See API key documentation for setup and capabilities.

Payments

  • Our payment processor handles card details. Card numbers never touch our servers.

Your data

  • Request logs power your Usage and Activity dashboards. Data handling and retention are described in the Privacy Policy.
  • Bulk downloads and samples expire 30 days after the job is created.
  • Bulk files are stored privately. Their storage lifecycle and our deletion commitments are described in the Privacy Policy and DPA.
  • Your query stream is never sold as a marketing dataset.

Privacy and agreements

  • Your privacy rights and how to exercise them are described in the Privacy Policy. Requests go to Email.
  • Our Data Processing Agreement applies to every plan when we process personal data on your behalf, including Bulk jobs.
  • Security questionnaires (SIG, CAIQ, your own) are answered on request: Email

Report a vulnerability

Found something? Email Email. Include the affected URL or endpoint, steps to reproduce, and the impact you observed. Redact API keys, tokens, and personal data from your report. Test only against your own account and data, and avoid disrupting the service.

Also see the Privacy Policy, DPA, and SLA. Contracts and invoice billing: Email