Security & Compliance

OilPriceAPI is built with enterprise security requirements in mind. This guide covers our security practices, our compliance posture, and best practices for secure integration.

We hold no security certifications. OilPriceAPI is not SOC 2 audited and not ISO 27001 certified, and we do not claim either. What we can tell you is exactly how the service is built and operated — that is what this page documents. If your procurement process requires a certified vendor, tell us early: we would rather say so up front than waste your review cycle.

Infrastructure Security

Data Centers

• Provider: DigitalOcean App Platform
• Regions: Primary in NYC, with edge caching globally via Cloudflare
• Redundancy: Multi-zone deployment with automatic failover
• Backups: Daily automated backups with 30-day retention

Network Security

• TLS 1.3: All API traffic encrypted in transit
• HTTPS Only: HTTP requests automatically redirected to HTTPS
• DDoS Protection: Cloudflare enterprise-grade DDoS mitigation
• Rate Limiting: Per-key rate limits to prevent abuse

Data at Rest

• Database Encryption: PostgreSQL with AES-256 encryption
• Key Management: Encrypted API keys using industry-standard hashing
• Audit Logs: Complete request logging for security analysis

API Security

Authentication

All API requests require authentication via API key:

Authorization: Token YOUR_API_KEY

API Key Best Practices:

1. Never expose keys client-side - Use server-side proxies
2. Use environment variables - Never hardcode keys in source
3. Rotate keys regularly - Generate new keys periodically
4. Use separate keys per environment - Development vs production
5. Monitor key usage - Check dashboard for unusual activity

Rate Limiting

Rate limits protect against abuse and ensure fair usage:

All plans share the same sustained rate limit of 60 requests per rolling 60-second window per API key; plans differ by monthly request quota:

IP Allowlisting (Enterprise)

Enterprise customers can restrict API access to specific IP ranges:

Contact support@oilpriceapi.com to configure IP allowlisting

Data Privacy

Data Collection

OilPriceAPI collects minimal data necessary for service operation:

• Request logs: IP address, endpoint, timestamp, response time
• Account data: Email, API keys, billing information
• Usage data: Request counts, error rates, popular endpoints

Data Retention

Your GDPR Rights

We have not been audited for GDPR, and "compliant" is not a status we assert about ourselves. What we do offer EU customers:

• Data Subject Rights: Request data export or deletion via support
• Data Processing Agreement: Available for enterprise customers
• EU Data Residency: Available on Enterprise plans
• Privacy Policy: oilpriceapi.com/privacy

Your CCPA Rights

For California residents:

• Do Not Sell: We do not sell personal information
• Data Access: Request your data via support@oilpriceapi.com
• Deletion: Request account deletion at any time

Compliance Posture

We hold no security or privacy certifications of our own. The table below states our actual position on each standard buyers commonly ask about, so you can assess us without a questionnaire round-trip.

Our hosting provider (DigitalOcean) and our payment processor (Stripe) hold their own certifications. Those are theirs, not ours — an OilPriceAPI customer inherits no certification from them, and we will not present a vendor's audit as though it covered us.

Security Review Requests

If your procurement process needs more than this page, contact enterprise@oilpriceapi.com. We will answer a security questionnaire and describe our controls in writing. We cannot supply an audit report we do not have.

Secure Integration Checklist

Server-Side Integration (Recommended)

# Good: Server-side with environment variable
import os
from oilpriceapi import OilPriceAPI

client = OilPriceAPI(api_key=os.environ['OILPRICEAPI_KEY'])
price = client.prices.get("WTI_USD")

Proxy Pattern for Frontend

Never expose API keys in client-side code. Use a backend proxy:

// Backend API route (Next.js example)
// app/api/prices/route.ts
import { NextResponse } from "next/server";
import { OilPriceAPI } from "oilpriceapi";

const client = new OilPriceAPI({
  apiKey: process.env.OILPRICEAPI_KEY!,
});

export async function GET() {
  const prices = await client.getLatestPrices();
  return NextResponse.json(prices);
}

// Frontend - calls your backend, not OilPriceAPI directly
const prices = await fetch("/api/prices").then((r) => r.json());

Webhook Security

When using price alerts with webhooks:

1. Use HTTPS - Webhook URLs must use HTTPS
2. Verify signatures - Every delivery is signed. We send an X-OilPriceAPI-Signature header containing an HMAC-SHA256 of payload.timestamp, computed with your webhook signing secret, plus an X-OilPriceAPI-Signature-Timestamp header. Recompute the HMAC and compare it in constant time before trusting a payload, and reject timestamps outside your tolerance window to prevent replay. See Webhook Signature Verification for language-specific examples, and the Webhooks API reference for the full delivery contract.
3. Implement idempotency - Handle duplicate deliveries gracefully
4. Set timeouts - Respond within 30 seconds

Incident Response

Security Incident Reporting

Report security vulnerabilities to: security@oilpriceapi.com

We follow responsible disclosure:

• Acknowledge receipt within 24 hours
• Provide status updates within 72 hours
• Credit researchers in our security acknowledgments

Status Page

Monitor service health: status.oilpriceapi.com

Subscribe to incident notifications via:

• Email alerts
• RSS feed
• Slack integration (Enterprise)

Enterprise Security Features

Available on Enterprise plans:

Contact enterprise@oilpriceapi.com for details.

Security FAQ

How are API keys stored?

API keys are hashed using bcrypt before storage. We never store plaintext keys after initial generation.

Can I rotate my API key?

Yes. Generate a new key in your dashboard, update your applications, then revoke the old key.

What happens if my key is compromised?

1. Immediately revoke the key in your dashboard
2. Generate a new key
3. Update all applications
4. Review usage logs for unauthorized access
5. Contact support if you notice suspicious activity

Do you share data with third parties?

We do not sell or share customer data. Third-party services we use:

• Stripe (payments)
• Postmark (transactional email)
• Sentry (error monitoring)

All third parties are bound by data processing agreements.

How do I request my data?

Email support@oilpriceapi.com with "Data Export Request" in the subject line. We'll provide your data within 30 days.

Contact

• Security Issues: security@oilpriceapi.com
• Compliance Questions: enterprise@oilpriceapi.com
• General Support: support@oilpriceapi.com