Banking
Core banking, deposits, loans, cards and net banking APIs.
Trust Center
Your customers' data stays in your services
Banks, insurers, hospitals, governments and every team with customer data can use ApiLense. Personal data is removed inside your own service, before anything is sent, and removed again before ApiLense stores anything. With strict privacy, only routes, timings and status codes ever leave.
PAN, Aadhaar, card and account numbers masked at the sourceStrict privacy for regulated teamsEncrypted in transit, short retention
Made for every sector that handles customer data
The same protections apply to every organisation: no special version, no extra price.
Finance & fintech
Payments, UPI, wallets, trading and lending platforms.
Insurance
Policies, claims, premium and agent portals.
Healthcare
Hospitals, labs, pharmacies and health records.
Government
Citizen services, tax, identity and public portals.
Retail & e-commerce
Catalogues, carts, orders, delivery and returns.
Telecom
Recharge, billing, SIM and network services.
Logistics
Shipments, tracking, fleets and warehouses.
Education
Admissions, exams, results and learning apps.
IT services & SaaS
Any team running APIs and microservices.
What leaves your service, in plain words
Sent to ApiLense
- Method, route and status code of each request
- How long it took, and how long the database took
- The shape of each SQL statement, with every value replaced by
?inside your service - Service name, version, environment and port
- Front-ends: page speed, error type and file and line, API wait times
Never sent
- Bodies of successful calls, headers, cookies, tokens and query strings
- Values in SQL: amounts, account numbers, names
- Passwords, OTPs, PINs and card numbers: masked inside your service
- Form fields typed on your web pages
- With strict privacy: no bodies at all, no ids in paths and no error text
Two layers of masking
1
Inside your service
Before anything leaves, the ApiLense client removes PAN, Aadhaar, card, account and deposit numbers, mobile numbers, IFSC codes, e-mail addresses, passwords, OTPs, PINs, tokens and JWTs. Personal data in a path becomes {masked}.
2
On ApiLense, before storing
Everything is masked again, so data from older clients, other languages or OpenTelemetry is protected too. A project marked strict keeps only routes, timings, status codes and error types, whatever a service sends.
Strict privacy for regulated teams
One switch on the project's Setup tab, or one line in the service: apilens.privacy=strict. ApiLense also tells every service of a strict project to stop sending, so the data never leaves at all.
- Paths as routes:
/fds/{fdNumber}, never/fds/FD2024000001 - No request or response body, not even for failed calls
- Errors as their type only:
CustomerNotFoundException - No machine names, no Try it relay, no database access from ApiLense
- Only an administrator can switch it off
What your service saw
GET /api/v1/fds/FD2024000001 404
CustomerNotFoundException: no customer
C100001 for PAN ABCPV1234F
{"pan":"ABCPV1234F","mobile":"9876543210"}What reaches ApiLense (strict)
GET /api/v1/fds/{fdNumber} 404
CustomerNotFoundException
(no body)How ApiLense protects what it keeps
Encrypted in transit
Every connection to apilens.org uses HTTPS (TLS) with certificates that renew automatically.
Passwords are one-way hashes
Sign-in passwords are stored as PBKDF2-SHA256 hashes with a salt and 210,000 rounds. Nobody, including ApiLense, can read them back.
Secrets are encrypted
Mail, payment and AI keys are stored with AES-GCM encryption and never shown again after saving.
Short retention
Request data is kept for up to 7 days and front-end data for 14 days, then removed. Deleting a project removes all of its data.
Access you control
Admin and member roles, access per project, and an audit log of who changed what.
Nothing in production by accident
The Java dependency and agent run on developers' computers only. Database access and the Try it relay are off by default and refuse to start in production.
Want nothing to leave your network?
Run ApiLense on your own server with Docker, inside your network. Same product, same features: your data never reaches us at all.
This page describes how ApiLense is built. Your own obligations (for example RBI data localisation or the DPDP Act) depend on your agreements: share this page with your security team, and ask us for anything they need in writing.