API documentation

API security

The security posture of the Stonewake API, on one page. The short version: the API can only read, only your workspace, only over TLS, and only with keys you created and can revoke at any moment.

Access

  • API access is off by default for every workspace and enabled by arrangement.
  • Keys are created by a workspace admin, shown once, stored only as a one-way hash, and revocable instantly.
  • Every read of workspace data authenticates; there are no anonymous reads.

Surface

  • The API is read-only. No endpoint creates, changes, or deletes workspace data, and API keys cannot manage keys, including themselves.
  • No personal-subject data is served on the API, whatever your workspace's settings.
  • Rate limits and daily quotas bound every key's traffic.

Isolation and data handling

  • A key reads exactly one workspace. Tenant isolation is enforced at multiple independent layers, from request scoping down to the database.
  • Key creation, revocation and last use are recorded; every key-authenticated request passes rate and quota controls.
  • The service is hosted in the EU and workspace data is stored in the EU.
  • Your workspace records are stored on our infrastructure and are never used to train models; search queries and fetched public text are processed by search and AI providers under the terms in the privacy policy, sections 7 and 8.
  • TLS everywhere: the API is served over HTTPS only.

Where the data comes from

The research base is public data: official company registers and gazettes, court and insolvency publications, regulatory filings (SEC EDGAR, for example), the LEI system (GLEIF), public procurement records, official statistics, licensed reference datasets, and reputable press. Responses that carry findings carry their source citations, and GET /v1/reference/datasets lists the reference datasets behind the country data with their licence and attribution lines. The obligations that travel with this data are stated under Terms of use.

The role of AI

  • /v1 serves stored, citation-backed data. Responses are deterministic reads of what your workspace already holds; nothing is generated at request time.
  • Some stored content is drafted with AI assistance: screening findings and deal memos include AI-assisted drafts, grounded in the cited sources and intended for review by your analysts.
  • Scores apply to organizations and countries, never to natural persons. Like the read-only surface, this is a design guarantee: no endpoint serves a person-level score.
  • Stonewake is a research and monitoring tool that supports human decisions. It takes no decision, executes no action, and is not an automated decision system.

Retention and offboarding

  • Workspace data is retained while your arrangement is active.
  • When the arrangement ends, you can export your reports and data during a wind-down period; workspace data is then deleted. Identifier-only entries of the append-only audit trail (event types, timestamps, acting user and object identifiers; no screening content) are retained after the arrangement ends.
  • The binding detail is in your customer agreement and the Terms of Service.

Reporting a security issue

Report suspected vulnerabilities, and anything that looks like an incident affecting your workspace, to contact@stonewake.ai with "Security" in the subject. Include what is needed to reproduce; never include live keys or workspace data in a report. Security documentation beyond this page is provided under the customer agreement, on request. Scope, safe harbour and response times are on the security disclosure page.

Questions beyond this page: contact@stonewake.ai.