Trust

What we hold, and what we don’t claim.

Uploaded lists and enrichment results may contain business contact information and, depending on the source, personal data. They are treated as sensitive customer data even when sourced from public pages.

AnyProspect is in controlled evaluation, not open launch. The controls below are real and deployed; the gaps below are equally real. Nothing here is a compliance certification, and the product is not described as GDPR or CCPA compliant because no reviewed basis for that claim exists.

Data handled

What the application can hold.

Uploaded CSV and Excel files
Shop and business names, source sheet, and original row data
Optional search context and run filters
Websites, domains, emails, phones, social links, and TikTok seller data returned by providers
User, session, organization, membership, and invitation records
Generated CSV output and local caches of provider results
Runtime progress, statuses, and error information

Data flow

Where an uploaded list actually goes.

Five steps, in order, with nothing omitted.

01
You upload a file to the application server.
02
Recognized name columns are parsed; the upload is stored under ignored local application data.
03
Names and any search context are sent to the configured third-party providers.
04
Responses are normalized, selected results cached, progress streamed to your session only.
05
Merged CSV output is available through an owner-scoped download route.

Active run state is currently held in process memory and does not survive a restart or a second replica. Uploads, caches, and generated files are filesystem-based.

Deployed today

Controls that actually exist.

Each of these is implemented in the running product, not planned.

Provider keys and calls are server-only: No third-party key is ever exposed to the browser.
Better Auth sessions: Replaces the former shared password. Public sign-up is disabled by default.
Database-backed rate limiting: Applied to authentication.
Owner-bound runs: Run lookup, event streaming, and downloads are scoped to the creating user.
Path containment checks: Applied to output downloads.
Role separation: Organization roles are distinct from global platform administration.
Last-owner guardrails: An organization cannot be left without an owner.
Generic-domain rejection: Reduces false seller-site matches reaching your export.

Third parties

Who else sees the data.

Business names and search context are sent to the configured lookup providers. Everything else runs inside the deployed environment.

Current integrations are RapidAPI-hosted website and TikTok services, and ScrapeCreators. PostgreSQL and hosting run within the application’s own deployed environment. Stripe is not connected.

Before open launch, each processor needs a documented data location, retention behaviour, contractual terms, and a statement of whether customer data may be used by that provider. That register does not exist yet.

Not yet in place

The gaps, stated plainly.

These are the reasons the product is not offered for open self-service use.

No published service-level objective, penetration test, or compliance attestation
No formal backup, restore, disaster-recovery, or incident-response documentation in the repository
No audit-event model for privileged actions
No end-user data export or deletion workflow
No defined automated retention or deletion policy for uploads, caches, and outputs
No documented subprocessor register

Responsible use

What the product is for.

Report a security issue

AnyProspect is intended for legitimate B2B research, seller partnerships, and compliant prospecting. Unlawful collection or use, harassment, spam, sensitive-trait profiling, credential abuse, evasion of platform controls, resale of data without rights, and attempts to identify private individuals for harmful purposes are all prohibited.

Whether a particular use is lawful in your market remains your determination. Enrichment can be incomplete or incorrect and should be reviewed before it is acted on.