Security & privacy
What's stored, what isn't, how keys are encrypted, and what security controls your account has.
We don't store your searches
The selector you enter into a tool (an email, a domain, a username...) is not permanently logged. It only persists if you explicitly save a result to Saved Investigations — that's always a deliberate action, never automatic.
Encryption of your API keys
Every provider key you connect (Shodan, VirusTotal, Hunter...) is encrypted with AES-256-GCM before being stored. Once saved, it's never shown in plaintext again — you can only replace or delete it. Keys are never shared between accounts, aside from the documented exception of the organization key in the Teams & Enterprise plans, visible only to members of that same organization.
Two-factor authentication (2FA)
You can enable TOTP-based 2FA (Google Authenticator, Authy...) from Settings → Security. Highly recommended if you use the platform for sensitive investigations.
Device limit
Each PRO account can be used from up to 2 devices at a time (say, your computer and your phone). Connecting a third one signs out the least-recently-used session — this keeps an individual license from being shared across several people. It doesn't apply within an organization, where every member has their own account.
GDPR
- You can export your account data and request a full deletion from Settings.
- Account deletion is real and irreversible — no history of your searches is kept.
- Third-party data providers queried by the tools (Shodan, VirusTotal, Hunter...) have their own privacy policies; OSINT UI acts as the intermediary running the query with your key, not as a store of that data.
Responsible use
OSINT UI is built for lawful use: professional investigation, journalism, defensive security and regulatory compliance. You're responsible for what you do with the information you obtain — see the full Terms of Use.
When you cancel your subscription
Cancelling stops future charges and you keep PRO access until the end of the period you already paid for. Your account data (including saved investigations) is not automatically deleted on cancellation — it's only removed if you explicitly delete your account, or after a long period of inactivity with prior email notice.