Security

Reporting a vulnerability

If you think you've found a security problem in the VatPulse API or website, please send a message through the VatPulse page on RapidAPI with "Security" in the subject (please don't include exploit details in the first message; we'll reply with a private channel). Include the affected URL or endpoint, steps to reproduce and the impact you expect. We aim to acknowledge reports within 3 business days and to keep you updated until the issue is fixed.

Scope and rules

• In scope: https://api.vatpulse.workers.dev (API and website).
• Please don't run denial-of-service or load tests, don't use automated scanners at high rates, don't access other customers' data, and don't social-engineer us or our providers. Use only test data (for example the sample VAT numbers and IBANs in our docs).
• Issues in third-party services we rely on (Cloudflare, RapidAPI or other marketplaces, VIES, HMRC) should be reported to those providers.
• We won't take legal action against good-faith research that follows these rules.

How we protect data

• HTTPS only. Data is stored in Cloudflare KV and Durable Objects, which are encrypted at rest.
• API keys are stored only as SHA-256 hashes; IBANs are never stored (only a keyed HMAC-SHA256 marker for 24 hours). See the Privacy Policy.
• Marketplace gateways authenticate with per-marketplace shared secrets, compared in constant time.

Incidents

If we become aware of a personal data breach, we will assess it promptly, contain it, and notify affected customers, the marketplace concerned and, where the law requires it, the relevant supervisory authority (in the UK, the ICO) without undue delay and within 72 hours of becoming aware of it. Where a breach affects data obtained from HMRC, we will also tell HMRC within 72 hours.

Machine-readable: /.well-known/security.txt