Public pages only, collected logged out
Everything CrustAPI returns comes from a page any visitor can open without an account. There is no logged-in session anywhere in our supply chain, so the data we hand you is data the source itself published. When a source withholds a field from public view, an employer hidden on a LinkedIn profile for example, we return a state flag that says so instead of a guess.
Self-assessed. Independent audit (SOC 2) is on our roadmap; no badge appears here until an auditor signs.
Our status page opens and closes incidents from real health probes against the live API, not from manual updates.
Support goes straight to the engineers who run the system, not a ticket tier. Write to support@crustapi.com and it lands with someone who can fix the problem the same day.
Infrastructure
Continuous off-site database replication about one second behind, health-gated deploys, and a public status page fed by real probes.
Product
Passwords hashed with scrypt, optional two-factor authentication (TOTP plus backup codes), sessions and sign-in links stored only as hashes, billing idempotent against webhook replays.
Data & privacy
We do not retain the results the API returns to you, and customer data is never used to train machine learning models.
Resources
Request any document and we send it for review. Most requests are answered the same day.
Documents are shared for evaluation and security review. Some are shared under NDA.
Controls
Every item below is implemented and in production today. Nothing here is planned or aspirational.
Infrastructure
Product
Billing integrity
Data & privacy
Organizational
Subprocessors
These providers process customer account data (your name, email, billing records, usage metadata, or delivered files).
Collection infrastructure
The suppliers that make up our data-collection infrastructure are engaged under confidentiality and data-protection terms. We do not publish that list, because it maps our supply chain, and it is disclosed to enterprise customers under NDA. These suppliers do not receive customer account data. They handle only the requests needed to fetch public pages.
If we add or replace a subprocessor that processes customer account data, we give at least 30 days notice by email, except where an urgent replacement is needed to keep the service secure or available, in which case we notify within 5 business days of the change.
FAQ
Sources of data
Where does CrustAPI's data come from?
Every record comes from a public web page, collected logged out, the same page any visitor sees without an account. API calls fetch the live page at request time; datasets are collected the same public-only way. We collect everything ourselves and do not buy or resell third-party databases. If the page does not show it, we do not return it.
Do you use fake accounts or login-gated data?
No. We never create accounts, never log in, and never bypass a CAPTCHA. Fields that only exist behind a login never appear in our responses, and where information is not publicly visible we flag it as such instead of guessing.
How do I know whether a field is hidden or genuinely missing?
Responses carry explicit state fields. On LinkedIn profile endpoints, companyState tells you whether the current employer is published, restricted from public view, or not published at all, and profileState separates a profile that exists but is not public from one that does not resolve. You always know which case you are looking at.
Data location
Where is customer data processed and stored?
Every provider we use is a United States company, and the systems holding your account and your data run in the United States: the API and its database on Fly.io in Ashburn, Virginia, the website on Vercel, payments on Stripe, transactional email on Resend. Two storage services are broader than that and we would rather say so: the continuous database replica on Tigris is held in globally distributed storage, and delivered dataset files on Cloudflare R2 are placed in North America. The suppliers that fetch public pages never receive customer account data.
Notice, consent and opt-out
Can a profile photo you return be one the person restricted?
No. A photo URL appears in a response only when the member's own visibility settings publish that photo on the public, logged-out page. Restricted photos never reach our systems, so the field is simply null. The photoState field states this per record, so you have a per-record answer on file.
How does someone opt out or request removal?
Email support@crustapi.com. Our privacy policy commits us to access, correction, deletion, and objection requests, and we answer GDPR requests within one month. There is no form maze; a person who can act on the request reads the inbox.
CCPA
Do you sell the personal information of people who opted out?
We do not sell or share our users' personal information, and we honor deletion and opt-out requests sent to support@crustapi.com without discrimination. The data our API returns is limited to what a public page shows any logged-out visitor at the moment you ask.
What CCPA rights can California residents exercise?
The rights to know, delete, correct, and opt out of sale or sharing, all described in our privacy policy. Send any request to support@crustapi.com. You will not be treated differently for exercising them.
GDPR
How does CrustAPI approach the GDPR?
We operate in alignment with the GDPR and our privacy policy spells out how: what we collect, the legal bases, retention, and your rights. This is a self-attested position, we are not yet independently certified. Our written policy set is available for review from the Resources tab.
How long do you retain data?
Account data is kept while your account is open and deleted on request. Usage metadata, meaning the parameters of your billed calls, is kept while the account is open and deleted sooner if you ask. We do not retain the results the API returns to you; the one exception is files you order, such as datasets, which we hold so you can download them.
What happens to customer data when an account is closed?
Email support@crustapi.com and we close the account and delete your account data: name, email, password hash, and API keys, along with the usage metadata that powers your request log. The results the API returned to you were never stored in the first place, so there is nothing extra to erase. Files you ordered, such as datasets, sit behind download links that expire on their own. We keep billing and tax records for as long as the law requires, as the privacy policy describes.
Do you sign Data Processing Agreements?
We have a DPA prepared for this. Request it from the Resources tab and we will send it for review. Where we process data on your behalf under a signed DPA, we act as your processor, as our privacy policy describes.
AI
Do you train AI models on customer data?
No. Our Information Security Policy permits customer data to be used only to operate, support, secure, and bill the service, and it prohibits using customer data to train machine learning models. We also do not retain the results the API returns to you, so there is nothing to train on.
Security and operations
How is access to production systems controlled?
Every provider console we use to run production has multi-factor authentication turned on, and the administrator device uses full-disk encryption with automatic screen lock. Inside the product, passwords are hashed with scrypt, session tokens are stored only as hashes, every API key carries a rate limit, and every account can turn on two-factor authentication with an authenticator app (TOTP) plus single-use backup codes stored only as hashes. The storage buckets that hold customer data are private, and we have verified they are not publicly readable.
Certifications
Is CrustAPI SOC 2 certified?
Not yet. SOC 2 is on our roadmap, and until an auditor has signed we will not show the badge. What we publish instead is the specific set of controls we run today, on the Controls tab, and our written policies are available for review on request.