Security and privacy

This page states what BINLookupAPI stores and how to ask for a deletion. Key handling for your application is on the API keys page.

Card numbers

The API needs the first 6 to 11 digits of a card number. Do not send more.

• A full card number is sensitive data under PCI DSS.
• The API does not need the full number. The first 6 to 11 digits identify the issuer.
• The API rejects a number value with more than 11 digits.
• In a batch response, a value with more than 11 digits is shown as [REDACTED]. See Batch lookups.

Cut the card number to the first 8 digits in your application before you send it. Eight digits is enough for a specific match on most ranges, and it stays inside the 11-digit limit.

How we store API keys

• BINLookupAPI stores a hash of each key. The key itself is not stored.
• The dashboard shows the first characters of each key only.
• You can revoke a key at any time. The key stops immediately.

BINLookupAPI cannot show a key after creation. See Create a key.

Request records

BINLookupAPI stores a record of each API request. The record contains:

• The API key that sent the request. The stored value is a hash, not the full key.
• The BIN that you sent.
• The HTTP status and the response time.
• The IP address of the client.
• The request headers, without the Authorization header and without other sensitive headers.
• The request body, limited to 1 KB.
• The response body, limited to 4 KB.

BINLookupAPI does not store a full card number. The API rejects it before it stores the request.

Records are kept while the account is open. This retention rule can change. A change is announced on the changelog.

The Usage page shows the request history. See the dashboard.

Service providers

BIN data comes from third-party vendors, banks, and the card networks. See Data sources.

BINLookupAPI hosts its database. Most of the data is in Europe.

The privacy policy and the terms are on this website.

Delete an organisation

You cannot delete an organisation or an account in the dashboard. Contact support to request a deletion.

Before you send the request:

1. Cancel the subscription.
2. Revoke the API keys.
3. Download the invoices that you need. See Invoices.

Send an email to support@binlookupapi.com. Include the organisation name and the email address of an owner. BINLookupAPI confirms the deletion by email.

Related pages

• API keys
• Data
• Billing
• Privacy policy
• Contact