CourtMesh API Security
    Skip to main content

    API Security

    How CourtMesh API security works, stated plainly: hosting and residency, key handling, audit logging, retention, breach process and subprocessors.

    Security posture

    Where we stand today

    For security reviews

    We walk Enterprise security teams through our controls, complete vendor security questionnaires and sign a security addendum as part of the contract conversation.

    In place today

    • India hosting, with data residency in India
    • TLS in transit; API keys hashed and shown once, never stored in the clear
    • Per account audit log, plus a request id on every response for support to trace
    • Organisation level IP allowlisting, opt in through support
    • A live right to be forgotten pipeline: our case removal and de-indexing process running in production

    A data processing agreement is available on request, and we will complete a CAIQ or SIG style vendor questionnaire and sign a security addendum with incident response terms as part of an Enterprise conversation.

    Retention

    What we keep, and for how long

    Request records
    Retained 90 days by default, then purged.
    Billing transactions
    Billing transaction records are purged on a time to live basis rather than kept indefinitely.
    Audit hits
    Per account API call records backing GET /audit and GET /usage are retained for billing, so your own usage history stays available to you.

    Breach process

    What happens if something goes wrong

    We notify affected customers within 72 hours of confirming a breach that affects their data or their account. That clock starts at confirmation, not at first suspicion, because an unconfirmed alert is not yet something we can respond to responsibly. What we send at that point: what is known so far, what we have already done, and what you should do on your side. A fuller report follows once the investigation is complete.

    Subprocessors

    Who else touches this data

    CourtMesh API subprocessors
    SubprocessorPurposeRegion
    AWSHosting, storage and computeap-south-1 (Mumbai)
    OpenAIAI analysis and adjudication, under a zero retention API usage agreementAPI, not self hosted
    RazorpayPayment processing for credit purchases and subscriptionsIndia

    Support

    Where to reach us

    support@courtmesh.ai for every plan, including security questions and incident reports. Enterprise customers get a named contact in addition to this address.

    Uptime and support response targets are on the Service Level Agreement page and take effect in Enterprise contracts. See Request ids and support in the API documentation for what to include when you write to us about a specific call.