Controls and limits
Trust & Security
How requests reach the API, what is stored from them, and what to agree by contract before production.
Last reviewed: 2026-10-08
HTTPS
Public API transport
API key
Organization access
99.9%
Internal availability target
stdio
Local MCP transport
API access and transport
documented
- The public API is served over HTTPS; API keys identify the organization and its plan.
- The MCP server runs locally over stdio but sends lookups and scan text to the API.
- Strip secrets and unneeded personal or customer data before sending a request.
Availability and reliability
internal target
- Internal target: 99.9% monthly API availability. Not a measured rate or a contractual SLA.
- The status page shows the API, database and Redis checks at the moment you load it.
- That check does not cover upstream sources or your integrations: plan failure handling.
Submitted data and retention
review requirements
- Lookups and scans are processed by the API, including those sent through MCP.
- A non-allow scan verdict with a source URL stores the URL, verdict, score and detection families, not the submitted text or organization ID.
- No automatic purge period or deletion deadline is published.
Privacy requirements
review before use
- Read the privacy policy before connecting a production workflow.
- Processing, retention and deletion terms are agreed on request, by contract.
Security assessment
evidence on request
- Not an independent security certification.
- Control evidence is provided on request, for a scope you define.
- Availability and support commitments apply only when written into a contract.
Responsible Disclosure
Report a vulnerability in isMalicious to contact@ismalicious.com with reproduction steps and the affected endpoint.
Data processing requirements
Need a data processing agreement? Contact us with your workflow and the data categories involved.