Legal
Security
What we do to protect your account and your lookups, concretely and without vague promises.
Draft. This text is pending legal review and is not yet binding. The technical part — what is stored and for how long — has been verified against the system.
Credentials
Neither passwords nor API keys are stored in plain text. For passwords we keep a cryptographic digest; for each key, its SHA-256 digest and a masked preview so you can identify it in the dashboard.
The practical consequence: if you lose a key, nobody — not even us — can recover it. It must be revoked and reissued.
Transport
All traffic is encrypted with TLS, both the site and the API. The key travels in the request header, never in the URL: that keeps it out of intermediate server logs and browser history.
Keys expire
Keys are issued with an expiry date and record their last use. You can revoke them at any time from the dashboard, and it is worth checking periodically whether any has gone unused for a while.
If you find a vulnerability
Write to contacto@perusoftware.pe with the steps to reproduce it. We appreciate a reasonable window to fix it before public disclosure, and we will not take action against anyone researching in good faith and without compromising third-party data.
What we ask: do not access data that is not yours, do not degrade the service, and do not publish other customers' information.