Security

Infrastructure

The application, database and file storage run on a server at Contabo GmbH in Germany, inside the European Union. All traffic is served over HTTPS; plain HTTP is redirected. Administrative access to the server is limited to the operator.

Accounts and API keys

• Passwords are stored as one-way hashes. API keys are stored as SHA-256 hashes; the full key is shown once, when it is created, and cannot be displayed again.
• A revoked key stops working immediately. Keys can be limited to a list of IP addresses and given their own rate limit.
• Two-factor authentication for password logins is not available yet. Signing in with Google uses the protection of your Google account, including its two-factor settings.

What happens to the names you send

• Small API requests are logged with their input for 7 days, so you can inspect recent activity and abuse can be investigated. Input logging can be switched off per API key.
• Uploaded files and their results are deleted 7 days after processing, or earlier if you delete them.
• Usage counters kept for billing contain no submitted values.

Backups

The database is backed up every night. Each backup is also copied to a private, access-restricted Cloudflare R2 bucket, encrypted at rest, and a missing backup is raised as a fault by the system check.

Sub-processors

These providers process data on our behalf. You will be told before a new one is added.

• Contabo GmbH (Germany): servers, database and file storage.
• Cloudflare, Inc.: encrypted off-site backups (R2) and the bot check on the sign-up form (Turnstile).
• Metunic (Türkiye): delivery of account email such as verification and receipts.
• Paddle.com Market Ltd (United Kingdom): card payments, as merchant of record. Card details never reach NameGender.
• Google LLC: Sign in with Google when you choose it, and Google Analytics only after you consent to analytics cookies.
• Anthropic PBC: the AI fallback, which is off by default and runs only after an explicit account-level opt-in. Only the name itself is sent.

Compliance

A GDPR Article 28 Data Processing Agreement applies to every account automatically; a countersigned copy is available on request. A Turkish KVKK disclosure notice is published alongside it. NameGender holds no SOC 2 or ISO 27001 certification.

Reporting a vulnerability

Send details to the address below (also listed in /.well-known/security.txt). Please do not test against other customers' data or run load tests against the production API. Reports are acknowledged within two business days.