---
title: "Security and Privacy"
description: "What BINLookupAPI stores about API keys and requests, card-number rules, service providers, and how to delete an organisation."
section: "Support"
url: "https://binlookupapi.com/docs/support/security/"
markdown_url: "https://binlookupapi.com/docs/support/security.md"
---
# Security and privacy

This page states what BINLookupAPI stores and how to ask for a deletion. Key handling for your application is on the [API keys](/docs/api-keys/#protect-a-key) page.

## Card numbers

The API needs the first 6 to 11 digits of a card number. Do not send more.

- A full card number is sensitive data under PCI DSS.
- The API does not need the full number. The first 6 to 11 digits identify the issuer.
- The API rejects a `number` value with more than 11 digits.
- In a batch response, a value with more than 11 digits is shown as `[REDACTED]`. See [Batch lookups](/docs/batch-lookups/#card-number-redaction).

Cut the card number to the first 8 digits in your application before you send it. Eight digits is enough for a specific match on most ranges, and it stays inside the 11-digit limit.

## How we store API keys

- BINLookupAPI stores a hash of each key. The key itself is not stored.
- The dashboard shows the first characters of each key only.
- You can revoke a key at any time. The key stops immediately.

BINLookupAPI cannot show a key after creation. See [Create a key](/docs/api-keys/#create-a-key).

## Request records

BINLookupAPI stores a record of each API request. The record contains:

- The API key that sent the request. The stored value is a hash, not the full key.
- The BIN that you sent.
- The HTTP status and the response time.
- The IP address of the client.
- The request headers, without the `Authorization` header and without other sensitive headers.
- The request body, limited to 1 KB.
- The response body, limited to 4 KB.

BINLookupAPI does not store a full card number. The API rejects it before it stores the request.

Records are kept while the account is open. This retention rule can change. A change is announced on the [changelog](/changelog/).

The Usage page shows the request history. See the [dashboard](/docs/support/dashboard/#usage-page).

## Service providers

| Provider | Purpose |
|----------|---------|
| Vercel | Application hosting. |
| Stripe | Payments and invoices. BINLookupAPI does not store card details. |
| Postmark | Transactional email. |
| Pylon | Customer support. |
| PostHog | Product analytics. |
| Google Analytics | Website analytics. |

BIN data comes from third-party vendors, banks, and the card networks. See [Data sources](/docs/support/data/#data-sources).

BINLookupAPI hosts its database. Most of the data is in Europe.

The [privacy policy](/privacy/) and the [terms](/terms/) are on this website.

## Delete an organisation

You cannot delete an organisation or an account in the dashboard. Contact support to request a deletion.

Before you send the request:

1. [Cancel the subscription](/docs/subscriptions/#cancel-a-subscription).
2. [Revoke the API keys](/docs/api-keys/#revoke-a-key).
3. Download the invoices that you need. See [Invoices](/docs/subscriptions/#invoices-and-payment-methods).

Send an email to [support@binlookupapi.com](mailto:support@binlookupapi.com). Include the organisation name and the email address of an owner. BINLookupAPI confirms the deletion by email.

## Related pages

- [API keys](/docs/api-keys/)
- [Data](/docs/support/data/)
- [Billing](/docs/subscriptions/)
- [Privacy policy](/privacy/)
- [Contact](/docs/support/contact/)