Security
A straightforward account of what we store, what we don't, and what we're built on, written for anyone evaluating whether to rely on JSON Support, not just to check a box.
Your Data
- The JSON/CSV data you convert is never stored. It's processed in memory by a serverless function and discarded the moment your file is generated. That hasn't changed since day one, for the free tool or the API.
- We don't have passwords to leak. Sign-in uses a signed, time-limited link sent to your email, so there's no password database to be breached in the first place.
- Payment details never touch our servers. Checkout and billing are handled entirely by Stripe; we only ever see a subscription status, never card numbers.
- For developer accounts, we store the minimum needed to operate: your email, your API key's identifier, and your plan tier. See the Privacy Policy for the full picture.
Transport & Access
- All traffic — the web app and the API — runs over HTTPS.
- API access is authenticated with per-developer keys, individually rate-limited and quota-enforced, issued and revocable independently of any other account.
- Infrastructure access follows least-privilege: each backend function has only the specific permissions it needs, nothing broader.
Infrastructure
JSON Support is built on established, independently-audited infrastructure providers rather than self-hosted servers:
- AWS (Lambda, API Gateway, DynamoDB) for the conversion API and account backend
- Vercel for the web app and CDN
- Stripe for payment processing
All three maintain their own SOC 2 and related compliance programs, which you can review directly on their sites. JSON Support itself is a small, early-stage service and does not yet hold its own independent certification — we'd rather say that plainly than imply otherwise.
Reporting a Vulnerability
If you find a security issue, please reach out through the Contact page rather than filing it publicly. We'll respond and keep you updated as we investigate.