Security

All traffic is served over HTTPS. When you deploy your static JSON to your own host (Cloudflare Pages/R2, Netlify, GitHub Pages, S3), your data at rest is encrypted according to that provider's platform defaults. StatikAPI outputs plain JSON files — no server process required — reducing attack surface and runtime risk.

The open-source CLI builds static files locally and doesn't collect your data. Static hosting plus cache-first delivery keeps runtime complexity near zero. Fewer moving parts means fewer places for things to go wrong.

We keep dependencies current, apply security patches promptly, and use automated checks (lockfile hygiene, vulnerability scans) during development. Simplicity in architecture helps updates stay small and auditable.

Private endpoints, API keys, and per-token rate limits are planned for StatikAPI. The hosted app is live at app.statikapi.com. The open-source tool does not gate or proxy your data — you control where and how it's hosted.

StatikAPI is designed for data-minimization. You choose the hosting location and retention policy of your JSON outputs. For StatikAPI App, we aim to align with common privacy frameworks (GDPR/CCPA) and will document data handling, subprocessors, and DPAs as the hosted product expands.

If something goes wrong, we'll communicate clearly and promptly: what happened, what's affected, and remediation steps. A public status page and audit log exports for StatikAPI are on the roadmap.

If you have specific security requirements or questions about your deployment setup, reach out — happy to walk through trade-offs and help you choose the safest option for your case.