How the ProcedureRadar API Handles Keys, Logs and Data
Security in one paragraph
The ProcedureRadar API serves published hospital and insurer prices, not patient data. We store API keys only as SHA-256 hashes and show each key once. Every data call needs a key and is rate limited, and our call log leaves out query parameters. We do not have a SOC 2 report or a standard DPA yet.
By Kevin Monangai, Founder, ProcedureRadar.
What we do not have yet
- No SOC 2 report. We have not been through a SOC 2 audit.
- No standard DPA. If your process needs one, ask before you buy and we will tell you plainly what we can sign.
If your review has a questionnaire, send it to [email protected] and we will answer it directly.
Before a careful buyer asks about price, they ask what happens to their key and their data. This page answers that plainly. We store keys only as SHA-256 hashes, our call log leaves out your query parameters, and we say what we don't have yet: no SOC 2 report and no standard DPA. If your review needs more, ask me directly.
How are API keys created and stored?
- Each key is 24 random bytes from a cryptographic generator, prefixed pr_live_ for live keys.
- We store only a SHA-256 hash of the key. The key itself is never saved in our database.
- You see a new key once: on the page right after payment, or in a secure message after a reviewed application. We cannot show it again, so a lost key is replaced, not recovered.
- A switched-off key is refused on its next call. When we rotate a key by hand, the old key keeps working for a grace period set for that rotation, 24 hours by default and never more than 7 days, and is refused after it.
How are requests limited and logged?
- Every data endpoint under /api/v1 needs a key in the X-API-Key header. No key, no data. Only the OpenAPI spec and the Postman collection are public.
- Each account has a per-minute and a per-month call limit. Past either one, the API returns HTTP 429 until the window resets.
- Your plan decides which metros, procedures and fields you get, and the server enforces it on every call. A Starter key cannot ask for a Scale field and get it.
- Each call that passes the key check and the rate limit writes one row to our call log: the path, the method, the calling IP address and the time. Calls refused at the key check or the rate limit are not written to that log.
- The path can name a hospital, since a hospital lookup puts its ID or slug in the path. Query parameters are not kept in our database. Vercel and Cloudflare keep their own request logs, which include full URLs with query strings.
Where does the data live, and who can reach it?
- Traffic reaches us through Cloudflare, which sits in front of the site and the API. The application runs on Vercel. Pricing data, accounts and call logs sit in a Supabase Postgres database.
- Your browser never talks to the database. Every query runs on our servers, and the database credentials exist only in server-side environment settings.
- The account, key and call-log tables have Postgres row-level security turned on.
- Payments go through Stripe Checkout. Card details go to Stripe and never touch our servers.
- All traffic is HTTPS. We send a two-year Strict-Transport-Security header, refuse to be framed by other sites, and turn off content-type sniffing.
How do you keep the data from being resold?
- Paid applications go through three automatic checks: a corporate email domain, a LinkedIn profile URL, and a short note on what you are building. An application that fails a check goes to a person for review instead of being turned down. Enterprise applications always go to a person. Free sandbox keys are issued by us by hand and do not go through these checks.
- The 25th and 75th percentile values in each account’s responses carry a small, fixed adjustment unique to that account, never more than 5 percent of the value. It lets us trace a leaked copy back to the account it came from. Medians, the 95th and 99th percentiles, means and posted prices are not adjusted.
- Our source code lives in a private repository.
Questions reviewers ask
Does the ProcedureRadar API store patient health information?
No. The API serves prices that hospitals and insurers publish under federal transparency rules. We never ask for, receive, or store patient records. What we hold about you is your company name, work email, the LinkedIn profile and use-case note from your application, and the API call log described on this page.
Does ProcedureRadar have a SOC 2 report?
No. We have not been through a SOC 2 audit, and we will not hand you a report we do not have. What we can do is answer your security questionnaire directly and point to the controls on this page. Email [email protected] with the questionnaire.
Will ProcedureRadar sign a data processing agreement?
We do not have a standard DPA today. The data we serve is public pricing, and the personal data we hold about you is limited to your application details and API call log. If your process requires a DPA, email [email protected] before you buy and we will tell you plainly what we can sign.
What does ProcedureRadar log when I call the API?
Each call that passes the key check and the rate limit writes one row to our call log: the path you called, the HTTP method, the calling IP address and the time. The path can name a hospital, because a hospital lookup puts its ID or slug in the path. We do not keep the query parameters in our database, so a pricing call shows that you called the pricing endpoint, not which procedure you asked about. Our hosting and network providers, Vercel and Cloudflare, keep their own request logs, and those include the full URL with its query string.
What happens if my API key leaks?
Email [email protected]. We switch the old key off, and a switched-off key gets an error on its very next call. We then issue you a new key. If you would rather rotate than switch off, we issue the new key and let the old one keep working for a grace period we set for that rotation: 24 hours unless you ask otherwise, and never more than 7 days. Rotation is something we do by hand on request; there is no automatic schedule.
How do I report a security problem?
Email [email protected] with what you found and how to reproduce it. A person reads every message, and we reply directly. Please do not test against other customers’ keys or data.
Try the API before your review closes
A free sandbox key covers Los Angeles, New York and Chicago at up to 10 calls a minute and 1,000 a month. We send it the same business day.