API documentation

API security

The security posture of the Stonewake API, on one page. In short, the API can only read, only your workspace, only over TLS, and only with keys you created and can revoke at any moment.

Access

  • API access is off by default for every workspace and enabled by arrangement.
  • Keys are created by a workspace admin, shown once, stored only as a one-way hash, and revocable instantly.
  • Keys work only on /v1 and the MCP server. Every other endpoint refuses a key exactly as it refuses an invalid one, so a key never reaches the dashboard's own endpoints or key management.
  • Every read of workspace data authenticates; there are no anonymous reads.

Surface

  • The API is read-only. No endpoint creates, changes, or deletes workspace data, and API keys cannot manage keys, including themselves.
  • The API serves data about natural persons, as official registers and the official sanctions lists state it and with its citations, only in workspaces where person data is switched on, never in the sandbox, and never as a score, rating or ranking.
  • Rate limits and daily quotas bound every key's traffic.

Isolation and data handling

  • A key reads exactly one workspace. Tenant isolation is enforced at multiple independent layers, from request scoping down to the database.
  • Key creation, revocation and last use are recorded; every key-authenticated request passes rate and quota controls.
  • The database, the API, the audit trail and the MCP server run on a dedicated server of a German provider in Helsinki, Finland. The web pages of the dashboard, the documentation and the website are delivered by Vercel, a US company, over its global delivery network, which also runs the request routing step of the website. All other server functions of the three run in its Frankfurt region. Sign-in runs through a managed service in London.
  • We store your workspace records on our infrastructure and do not train models on them; search queries, fetched public text and the text sent to AI providers for drafting, including the subject of a screening, are processed by search and AI providers under the terms in the privacy policy, sections 7 and 8.
  • TLS everywhere. The API is served over HTTPS only.

Where the data comes from

The research base is public data. It covers official company registers and gazettes, court and insolvency publications, regulatory filings (SEC EDGAR, for example), the LEI system (GLEIF), public procurement records, official statistics, licensed reference datasets, and reputable press. Responses that carry findings carry their source citations, and GET /v1/reference/datasets lists the reference datasets behind the country data with their licence and attribution lines. The obligations that travel with this data are stated under Terms of use.

The role of AI

  • /v1 serves stored, citation-backed data. Responses are deterministic reads of stored data, and no model runs at request time.
  • Some stored content is drafted with AI assistance. Screening findings include drafts grounded in the cited sources and intended for review by your analysts. The deal summary is not drafted by a model; its three lines are generated from the cited findings by fixed rules. A deal briefing, where a deal carries one, is drafted by a model from the text of the deal's cited sources. Only its numbers written in digits are checked against that text before it is stored and shown.
  • Scores apply to organizations and countries, never to natural persons. Like the read only surface, this holds by design, and no endpoint serves a person level score.
  • Stonewake is a research and monitoring tool that supports human decisions. It takes no decision, executes no action, and is not an automated decision system.

Retention and offboarding

  • Workspace data is retained while your arrangement is active.
  • When the arrangement ends, you can export your reports and data during a wind-down period; workspace data is then deleted. The entries of the append-only audit trail are retained after the arrangement ends. They hold identifiers (event types, timestamps, the acting user and the objects acted on, among them the email address of a member an administrator invited or removed or who first signed in through single sign on) and no screening content, except feedback reports, which keep their text and the reporter's email address until a scrub removes both from entries older than 180 days.
  • The binding detail is in your customer agreement and the Terms of Service.

Reporting a security issue

Report suspected vulnerabilities, and anything that looks like an incident affecting your workspace, to contact@stonewake.ai with "Security" in the subject. Include what is needed to reproduce; never include live keys or workspace data in a report. Security documentation beyond this page is provided under the customer agreement, on request. Scope, safe harbour and response times are on the security disclosure page.

Questions beyond this page go to contact@stonewake.ai.