Data protection

How we protect your data

What runs on every request to the API, how the catalog is kept from being bulk-copied, how your keys and account are guarded, and which policies stand behind it. The figures on this page are read from the configuration that enforces them.

118/135operations need a key
17open without a key
33answer 304 Not Modified
8refuse oversized bodies
39documented error reasons
4plans, each a separate limiter

What every request passes through

The API is one pipeline and the order is the contract: a request is identified, hardened, throttled and metered before a handler runs, and a cached read still runs every stage. Each row names what a caller can observe.

1
TLS onlyStrict-Transport-Security
Every endpoint is HTTPS. Plain HTTP is redirected, and HSTS with preload tells browsers never to try it.
2
Hardening headersX-Content-Type-OptionsX-Frame-OptionsReferrer-Policy
Content sniffing, framing and referrer leakage are switched off on every response. SVGs the API serves carry a sandboxing Content-Security-Policy, because an SVG opened from our origin would otherwise run script with our authority.
3
Origin allow-listAccess-Control-Allow-Origin
Browsers may call the API only from origins we name. Everything else gets no Access-Control-Allow-Origin and the browser refuses the response.
4
Body ceiling413 PAYLOAD_TOO_LARGE
A request body over 1 MB is refused from Content-Length before a byte is read, so nothing is stored and the request can be split and resent.
Read more
5
Incident brakes and client guards403 CLIENT_BLOCKED503 MAINTENANCE
A blocklist by address, a guard for empty or known-scraper user agents, and operator switches for maintenance, read-only and full stop. The console is deliberately outside all of them, so an outage can always be turned off.
Read more
6
The website is not a customer
gunspec.io reaches the API through a proxy that adds a server-side token the browser never sees. It holds no API key and no tier, so nobody can borrow the site's credential to read the catalog for free.
7
Signed browser traffic403 ORIGIN_BLOCKED
A browser request that claims a GunSpec origin but carries no key must be signed with an HMAC that expires after 5 minutes. An unsigned one is refused rather than served anonymously.
Read more
8
Your key401403
Sent as X-API-Key or Authorization. A missing, malformed or expired credential is a 401; a valid credential that is not permitted is a 403, and the error says which so you never rotate a key that was fine.
Read more
9
Per-minute limit429 RATE_LIMITEDRetry-After
One Cloudflare rate limiter per plan, keyed by your key. Over it, Retry-After says how long to wait.
Explorer
10/min
Builder
60/min
Studio
120/min
Enterprise
300/min
Read more
10
Daily cap429 DAILY_CAP_EXCEEDED
A second ceiling per key, reset at midnight UTC. A 304 revalidation does not count against it.
Explorer
50/day
Builder
2,000/day
Studio
10,000/day
Enterprise
50,000/day
Read more
11
Pagination burst429 PAGINATION_BURST
Walking 10 or more sequential pages inside 90 seconds is refused. A mirror should use a larger per_page, or webhooks.
Read more
12
Page depth403 PAGINATION_DEPTH_EXCEEDED
How far a plan may page into a list. Filters narrow a list; deep paging enumerates it.
Explorer
5 pages
Builder
25 pages
Studio
∞
Enterprise
∞
Read more
13
Field shaping
Responses are shaped per plan in one place, after the handler. The free plan sees 7 list fields and a summary detail view; paid plans see full specifications.
Read more
14
Conditional requestsETag304 Not Modified
33 read operations answer 304 Not Modified to a matching If-None-Match. The ETag is a hash of the exact body for your plan, never of the record, so a shared cache can never serve one plan's body to another.
Read more
15
Edge cache keyed by planVary: X-API-Key
Public reads are cached at the edge, keyed by access tier and caller kind. Every /v1 response carries Vary: X-API-Key so no proxy between us reuses a response across credentials.
Read more
16
Request idX-Request-Id
Every response carries X-Request-Id, and every error echoes it as request_id. Quote it to support; it finds the request in our logs.
Read more

Keeping the catalog from being copied

The dataset is the product. These limits make a full copy expensive at every plan while an ordinary integration never meets them.

Field shaping

The free plan's list rows carry 7 fields and its detail view 19; paid plans receive full specifications. Applied once, after every handler, so a new endpoint cannot forget it.

id
name
manufacturerId
manufacturer
updatedAt
version
provenance

Which fields are which

Page depth

The deepest page number a plan may request.

Explorer: 5 pages
Builder: 25 pages
Studio: ∞
Enterprise: ∞

How pagination works

Daily request cap

On top of the monthly quota and the per-minute limit.

Explorer: 50 per day
Builder: 2,000 per day
Studio: 10,000 per day
Enterprise: 50,000 per day

Total counts

Whether a list response says how many records match. Hidden on the free plan, so the size of the dataset cannot be gauged from it.

Explorer: —
Builder: ✓
Studio: ✓
Enterprise: ✓

Pagination burst

10 or more sequential pages within 90 seconds is refused with a 429. Filters and larger pages are the way to read more; webhooks are the way to stay current.

How pagination works

Assets and SVGs

Line art and model URLs reach API keys as absolute, fetchable URLs and reach the website as obfuscated paths only its own decoder reads. Every SVG the API serves is sandboxed:

Content-Security-Policy
default-src: 'none'
style-src: 'unsafe-inline'
img-src: data:
sandbox: set, no value

Your keys, sessions and our operators

The account side: how a credential is stored, limited and audited.

What	How
API keys	Sent as X-API-Key, Authorization over TLS only. Create, disable and revoke from your profile; revocation is immediate. A disabled or expired key answers `401` with a reason that names which.
Key-sharing detection	Request headers are hashed into a client fingerprint. When 3 or more keys share one fingerprint, the account is flagged for rotation. The check runs after the response, at no latency cost.
Website sessions	Separate from API keys and from the staff console. The cookie is `HttpOnly`, `Secure` and scoped to our domain; writes from a signed-in account are limited to 60 a minute; a session that expires is a `401 SESSION_EXPIRED`, not a silent logout.
Sign-in throttling	10 attempts per address per 1 hour on the login surface, so credential stuffing runs out of tries before it runs out of guesses.
Sealed secrets	Credentials operators paste into the console are encrypted with authenticated encryption before they touch the database, so a leaked backup is not a leaked account.
Staff audit trail	Every mutating staff action is written to an append-only log: who, what, when, from where. Request bodies are never stored, so the log cannot leak a secret.
Kill switch, maintenance, read-only	Operators can pause the public API without touching the console. You receive a `503` with `Retry-After` and a named reason. See the 503 reasons.
Webhook deliveries	Every delivery is signed: `X-Webhook-Signature` is `t=TIMESTAMP,v1=HMAC_SHA256_HEX(TIMESTAMP + "." + BODY)`, over a secret only you and we hold. Failed deliveries retry after 1, 5, 15 minutes. Verification guide. Studio 5 Enterprise 20

Headers on every response

Set by the API on all routes; the website sets the same family plus a Content-Security-Policy and Permissions-Policy of its own.

Header	Value
`Strict-Transport-Security`	`max-age=31536000; includeSubDomains; preload`
`X-Content-Type-Options`	`nosniff`
`X-Frame-Options`	`DENY`
`Referrer-Policy`	`strict-origin-when-cross-origin`
`Cross-Origin-Resource-Policy`	`cross-origin`
`Vary`	`X-API-Key, Accept-Encoding`

Privacy and compliance

The catalog is public technical data and carries no personal information. Personal data is what an account needs: an email address, a plan, usage records. This is how it is handled.

GDPR and the Australian Privacy Principles. Buun Group is an Australian company; the Privacy Policy sets out your rights of access, correction, deletion, portability and objection under both.
Data Processing Agreement. Published online; a countersigned copy with the EU standard contractual clauses is available on request.
Breach notification. Without undue delay after we become aware, with what you need to meet your own obligations.
International transfers. Data is processed in Australia and the United States on Cloudflare's network, under standard contractual clauses.
Retention. Account data is deleted within 30 days of account deletion. API usage logs are kept 90 days, billing records 7 years as tax law requires.
Opt-in analytics. Analytics loads only after consent from the cookie banner. Authentication and security cookies are the only strictly necessary ones.
Data minimisation. Card details never touch our systems; Stripe holds them. Error logs record a code and a request id, never a request body.
We crawl politely too. Where our own pipelines fetch a third-party page, they honour robots.txt and back off on refusal, cached per origin.

Who processes data

Subprocessor	Role	Region
Cloudflare	hosting, edge compute, database, object storage, security	US and global
Stripe	payments and subscription billing; card details never touch us	US and Ireland
Google Analytics	opt-in analytics, loaded only after consent	US
Resend	login codes and account email	US
Sentry	error reports from the website only; the API never reports to it	US

The policies

Found a weakness? The Security page says how to report it, or write to security@gunspec.io.