In the product
What you can check.
Hosting, opt-out, prices, the OpenAPI spec, MCP clients, and the security controls that are on.
- 01
EU hosting
Production Postgres is a Supabase project in Frankfurt (eu-central-1). Railway runs the web service and the worker beside that EU database.
- 02
Opt-out is enforced
A confirmed opt-out is stored as a hash and removed from search, contact lookup, and outreach. The form is public. The privacy page describes the Article 21 request and is still a placeholder until a lawyer reviews it.
- 03
Prices per result
A returned lead is 1 credit. A live profile is 2. A live company lookup is 1; an unknown, cached, or already-known company is free. The price of a found contact is on the pricing page and in the estimate before the lookup runs. Outreach is €49 per connected account per month, not per message.
- 04
OpenAPI spec
The HTTP API is published as OpenAPI. The API reference is rendered from that spec, and /openapi.yaml is the file. The TypeScript and Python clients in the repository are generated from the same spec.
- 05
MCP clients
Setup pages exist for Claude Desktop (mcp-remote), claude.ai (OAuth), and Claude Code. The server speaks Streamable HTTP at /mcp and /api/mcp. A client that speaks that protocol uses the same endpoint.
- 06
Security controls
API keys are shown once and stored as a SHA-256 hash. Spend and sends wait for confirm. An Idempotency-Key replays for 24 hours and returns 409 when the body differs. Responses set X-Content-Type-Options to nosniff, X-Frame-Options to DENY, Referrer-Policy to no-referrer, and a Permissions-Policy that disables camera, microphone, and geolocation. Production also sends HSTS.