This page describes how the 96Astro API protects your account and your data. It matches what the service does today; the privacy policy and the data processing agreement are the binding documents.
Where the service runs
- The website, API, calculation engine, database, backups and our own mail server run on a virtual private server from Contabo GmbH in Germany. We run our own mail server; no separate email provider handles our email.
- Internal services (the calculation engine, the database) listen only on the server itself, not on the internet.
- The subprocessors page lists every other service that receives customer data.
Encryption
- All traffic to the website and the API uses HTTPS (TLS).
- API keys are never stored. We keep only a keyed one-way hash (HMAC-SHA256 with a server-side secret), so a copy of the database cannot be used to recover or test keys, and nobody at 96Astro can show you a key again after it is created.
- Passwords are stored only as hashes.
- Secrets that staff save in the admin panel (for example provider credentials) are stored encrypted, with a key held outside the database.
Controlling who can use your keys
- Sandbox and live keys. Sandbox keys (
sk_test_) run real calculations under daily limits and never use credits. Live keys (sk_live_) use credits. - Scopes. A key can be limited to chosen capability families or single capabilities. A call outside the scope is refused with
403 key_scope_deniedbefore anything is charged. - IP allow-lists. A secret key can be limited to listed IP addresses or ranges (IPv4 and IPv6). Other addresses get
403 ip_not_allowed. - Publishable keys. For browser widgets we offer separate
pk_keys. They work only from the websites you list, reach only the widget capabilities, have their own rate limits and never reveal your credit balance. They are not secret; keep secret keys on your server. - Teams and roles. Each member of your organization has a role (owner, admin, developer, billing or viewer). Two-factor authentication is available for every account and required for our staff.
- Sign-in. You sign in with an email address you have confirmed through the link we email you and a password, or with your Google account. Sign-in attempts are rate-limited, and repeated wrong two-factor codes lock the sign-in for a while.
- Revocation. Revoke a key in the dashboard and it stops working at once.
- Spend control. Overage is off unless an owner turns it on with a monthly cap, and calls stop when the cap is reached.
See the key restrictions guide for how to set these up.
Protecting the service
- Rate limits apply to every key, and publishable keys also have a per-visitor limit.
- Webhooks we send you are signed (
Astro-Signature) so you can verify them. The addresses you register are checked so that a webhook cannot be pointed at private or internal network addresses. - PDF and audio reports, data exports and hosted chart images are served through signed links that expire; an altered link does not work.
- Files we serve for download are sent with headers that stop browsers from running them.
- Administrative actions by our staff are recorded in an audit log, and staff access is role-based.
Your data, its retention and its deletion
| Data | Kept |
|---|---|
| Web server access logs | 10 days |
| Hosted chart images (the signed image URLs) | 24 hours after the last request that produced them |
AI chat conversations (/v1/conversations) | 30 days after the last activity |
| Palm and face photos | Not stored; used for the one call |
| Audio reports | 7 days (download links 24 hours) |
| PDF reports | 7 days (download links 24 hours) |
| Stored responses for idempotent retries | 24 hours |
| Webhook delivery log | 30 days |
| Error log (no request body) | 90 days |
| Database backups | 14 days on the server |
The full list, including invoices (kept 8 years as Indian GST law requires), is in the privacy policy. Account owners can export their account data and ask for the account to be deleted under Your data in the dashboard. Deletion revokes all keys, removes webhooks, team data, the billing profile, stored files and support messages, and anonymises the organization; tax records are kept for the period the law requires.
- We do not use your API data to train AI models, and we do not sell personal data.
- The database is backed up every night on the server. Each backup file is checked to be a complete, readable archive when it is made. Backups are kept for 14 days and then deleted. An off-server copy (to another folder or server, or to an S3-compatible storage bucket) can be turned on in our backup settings; it follows that destination's own rotation, and a storage provider is added to the subprocessors page before the first copy is sent.
AI features
AI readings and chat, and palm and face readings, are written by Anthropic, with OpenAI as fallback. They receive the computed chart data, the question or the photo you send, not your account details. Audio reports are spoken by Google, which receives the written script. See subprocessors.
Reporting a vulnerability
Email support@96astroapi.com with "Security" in the subject and enough detail to reproduce the problem. Please do not access other customers' data, disrupt the service or publish details before we have had a chance to fix the issue. We read every report and reply to the sender.
Incidents
Our status page shows current incidents and planned maintenance. Our status monitor checks the API once a minute, and a separate check from outside our server runs every 5 minutes, so an outage is noticed even when the server itself is down. If a breach affects personal data, we notify affected customers without undue delay, and the authorities where the law requires, as described in the privacy policy.
Questions
Security questionnaires and requests for the data processing agreement go to support@96astroapi.com.