TasteRay API Security and Data Handling
Written for the person who has to sign off the vendor: where a request goes, what stays behind, and what we do not hold yet.
TasteRay's API is stateless: it stores no user profiles between requests, and pseudonymous profiles work. Request logs are kept for up to 90 days, and request context goes to AI model providers to generate answers. A DPA is available on request. SOC 2 Type II and ISO 27001 are both in progress.
The binding statement is the API privacy policy, last updated 5 July 2026. This page explains it for a security or legal reviewer, with the parts a reviewer tends to ask about stated plainly.
Where a request goes
Your server sends the request over TLS. The API runs on Cloudflare Workers, and each request passes through these stages.
Authentication
The API key is hashed with SHA-256 and looked up. The plaintext key is never stored.
Rate limiting
A sliding one-minute window counts requests against the key's tier.
Validation
The body is checked field by field. A failure returns 400 before any model is called.
Generation
A versioned prompt is compiled with your context and sent to an AI model, with a second model as fallback. With grounding on, the model may search the web, and
meta.tool_usagereports the searches.Response
The output is validated against a JSON schema and returned to you, and the request is logged and traced.
What stays behind
Stateless means no profile is kept and reused between requests: each call carries all the context it needs. It does not mean nothing is written down. Requests and responses are logged for debugging and analytics, for up to 90 days.
| Data | What is kept | For how long |
|---|---|---|
| User profiles and sessions | None stored by the API | Not applicable |
| Request logs | Request and response data, including the context you send | Up to 90 days |
| API keys | A SHA-256 hash, never the key | Not stated in the policy; ask us |
| Rate-limit counters | Counts per key | Two minutes |
| Usage records | Requests per key and endpoint | Not stated in the policy; ask us |
| Account details | Email, optional name and organization, billing details on paid tiers | Until you delete your account |
Who else sees a request
- AI model providers
- Your request context is processed by the AI models that generate the answer. The policy does not name them, so ask us for the current list with your DPA request.
- Service providers
- The policy lists vendors such as cloud hosting and payment processing.
- Web search
- Grounding lets the model search the web and is off by default when you send
items. Fast mode turns it off outright, and that is the setting to use when your catalog is the whole truth. - Other countries
- The policy says data may be transferred to and processed in other countries, with safeguards under applicable law. Raise any residency requirement before a pilot.
One clause to read closely
The privacy policy lists "Enhance our recommendation algorithms and model accuracy" among the uses of information collected through the API. It also says TasteRay does not sell personal information to third parties for marketing. If your counsel needs the first of those limited for your data, raise it with your DPA request.
What to send, and what to keep
You choose what is in each request, which makes this the strongest control you have.
- Use a pseudonymous identifier or none at all. The API reasons about preferences and never needs an identity.
- Leave out names, email addresses, account numbers and payment data. They do nothing for a recommendation.
- Keep the key on your server and rotate it if it reaches a log or a repository.
- Keep children under 13 out of the integration: the policy says the service is not intended for them.
- Read the policy before you send anything regulated, and talk to us first.
Status
| Item | Status |
|---|---|
| SOC 2 Type II | In progress |
| ISO 27001 | In progress |
| Data processing agreement (DPA) | Available on request |
| Encryption in transit | TLS |
| API key storage | SHA-256 hash |
| Privacy policy | api.tasteray.com/privacy |
The ForMe widget
ForMe runs on your product page and talks to TasteRay directly from the visitor's browser, with no account and no API key on your side. Its install page says returning visitors get faster matches because the widget keeps their taste profile in localStorage. Treat it as you would any third-party script in your consent and content security reviews.
Sources and further reading
FAQs about TasteRay API Security and Data Handling
Does the TasteRay API store user profiles?
No. The TasteRay API stores no user profiles or sessions, so every request carries the context it needs and you decide what user data leaves your system. Request logs are a separate matter: they hold request and response data for up to 90 days, for debugging and analytics.
Does TasteRay send our data to AI providers?
Yes. Request context is processed by the AI models that generate each answer, as the TasteRay privacy policy states. Send pseudonymous context and leave out direct identifiers, since the API never needs an identity. Ask us for the current list of providers when you request a data processing agreement.
Does TasteRay offer a data processing agreement?
Yes, TasteRay offers a data processing agreement on request. Email hello@tasteray.com and say which product and territories you are reviewing. It is usually handled while scoping a pilot, so your legal team sees it before any viewer data moves. Certification work for SOC 2 Type II and ISO 27001 is in progress.