• API keys are confidential credentials.
• Customer must rotate compromised keys and notify postal.ID.
• Use IP allowlisting where available.

We may impose rate limits to protect service availability. Excessive use or abuse may result in throttling or suspension.

Customer is responsible for verifying webhook signatures and securing webhook endpoints.

No scraping, enumeration, or unauthorized security testing without written permission.

We will provide reasonable notice for breaking changes and deprecations.

API requests may be logged for security and troubleshooting, subject to retention.