DRAFT — for review. Regions and controls below are indicative; request a data-processing agreement for contractual specifics.
Security & Architecture
ReqRes Security & Architecture Summary
Generated 28 July 2026. A plain-English summary for procurement and security review.
What ReqRes is
ReqRes is a hosted test and mock API for developers. Users create mock datasets and endpoints to build and test software against. It is a development and testing tool, not a system of record.
What data ReqRes stores
- Fixture / mock data only. The data users put into ReqRes is sample and test data. ReqRes is not intended for production personal data or sensitive data, and our terms prohibit storing it.
- Account data. Email address and authentication identity for account holders (via our auth provider), and subscription/billing records (via our payments provider). We do not store card numbers.
- Operational logs. Request metadata and usage counts for rate-limiting, analytics and abuse prevention, retained on a rolling basis.
Architecture
- Application: Node.js / Express API and server-rendered marketing site; a React dashboard for account holders.
- Data: PostgreSQL (managed) for account, project and usage data; Redis for rate-limiting and caching.
- Edge: Cloudflare provides TLS, DNS, CDN and an edge firewall. The firewall filters roughly 13 billion automated requests a month before they reach the application (see docs/metrics.md provenance).
- Transport: HTTPS/TLS everywhere; HTTP is upgraded to HTTPS.
Subprocessors
| Provider | Purpose | Region (indicative) |
|---|
| Heroku (Salesforce) | Application hosting, PostgreSQL, Redis | US / EU |
| Cloudflare | DNS, CDN, TLS, edge firewall | Global edge |
| Stripe | Payments and invoicing (PCI-DSS; we do not store card data) | US / EU |
| Clerk | Authentication and account identity | US |
| Resend | Transactional email | US |
| Loops | Lifecycle email | US |
| PostHog | Product analytics | EU |
| OpenAI | Optional AI-assisted features | US |
Security posture
- TLS in transit; secrets held in environment configuration, not in source control.
- Edge firewall and rate-limiting to absorb automated abuse.
- Managed database with the provider's continuous backups / point-in-time recovery.
- Payments handled entirely by Stripe; ReqRes never sees or stores card details.
Honest scope
ReqRes is run by a small team. We do not currently hold formal certifications such as SOC 2 or ISO 27001. Because ReqRes is a mock-data tool and is not intended to hold production personal data, most buyers licence it without a full vendor-security review. We are happy to complete a reasonable security questionnaire and to sign a data-processing agreement on request.