Security

Reporting a vulnerability

Email hello@kynth.studio. Include the URL, what you did, and what you saw. There is no bounty and no NDA to sign. We will confirm receipt, and we will tell you what we changed.

The same address, with a machine-readable expiry, is published at /.well-known/security.txt under RFC 9116.

Accounts

ParseRail has user accounts. What is stored against one, and who else touches it, is below.

What is stored

• Your account: the email address you sign in with, your API keys (stored as a hash and a short prefix — the full key is shown once and never again) and your credit balance
• A usage row per call: which endpoint, when, whether it succeeded and what it cost in credits. That ledger is what your balance is computed from
• The documents you send are processed to produce the response and are not retained as training data or kept for our own use
• Anonymous usage analytics on this marketing site — page views and clicks

Who else processes data

• Supabase — authentication, the key store and the usage ledger
• Stripe — takes credit top-ups and holds the card details — we never see a card number
• Google — the OAuth sign-in option, if you use it
• Vercel — serves this site and the API, and holds their access logs

Also true

• An API key is stored as a hash plus a short prefix. The full key is displayed once, at creation, and cannot be recovered — which is why revoking and reissuing is the only recovery path, and why that is the honest design.
• Credits are charged on success only. A call that errors does not bill, so a broken integration cannot quietly drain a wallet.
• Sign-in lives on api.kynth.studio rather than on this host, deliberately: Supabase cookies and the OAuth redirect URIs are host-scoped, and serving the gate on the marketing host bounce-loops it.
• The playground runs against the real endpoints without an account. Whatever you paste into it is processed the same way and kept the same way — which is to say, not kept.

ParseRail is built and run by Kynth Studios. The declarations on this page are part of this product's own configuration and are re-checked at every deploy against the repository they describe: a product that claims to have no accounts and ships an authentication route fails the build, and so does one that takes payment without naming its payment processor here.