Production Endpoints
| Service | URL |
|---|---|
| API | https://api.imarobot.ai |
| Developer Portal | https://app.imarobot.ai |
| Docs | https://docs.imarobot.ai |
Technology Stack
API
- Runtime: Node.js 20 / Express
- Hosting: Railway — US region
- Authentication: Bearer token (
sk_live_/sk_test_/pk_live_), keys stored as SHA-256 hashes — plaintext never persisted - Rate limiting: Sliding window per API key and IP, tiered by plan
- Versioning: All endpoints versioned under
/v1/
Developer Portal
- Framework: React + TypeScript, built with Vite
- Hosting: Railway — US region
- Auth: Clerk — SOC 2 Type II certified
Database
- Provider: Supabase — PostgreSQL
- Security: Row Level Security (RLS) enforced on all tables — every query is scoped to the requesting organization
- Region: US East
DNS & CDN
- Provider: Cloudflare — DNS, CDN, DDoS protection, TLS termination
Sub-Processors
ImaRobot uses the following third-party sub-processors to deliver the service:| Provider | Purpose | Data processed |
|---|---|---|
| Railway | API & portal hosting | Code, logs, environment variables |
| Supabase | Database | Organizations, users, agents, API keys, verification logs |
| Clerk | User authentication | User identities, sessions |
| Stripe | Billing & payments | Payment methods, subscription data |
| Resend | Transactional email | Email addresses, send history |
| Cloudflare | CDN & DNS | Request logs (transient, not persisted) |
| Sentry | Error tracking | Stack traces, request context (no PII) |
| PostHog | Product analytics | Usage events, pageviews (anonymized) |
Data Retention
Log retention is determined by your plan:| Plan | Monthly verifications included | Verification log retention |
|---|---|---|
| Free | 500 | 30 days |
| Builder | 5,000 | 30 days |
| Developer | 25,000 | 90 days |
| Growth | 100,000 | 1 year |
| Enterprise | Custom | Custom (negotiated) |
Security Practices
- API keys — stored as SHA-256 hashes; the full key is shown once at creation and never again
- Agent tokens — signed JWTs using RS256 with rotating key pairs
- TLS — all traffic encrypted in transit via Cloudflare (TLS 1.2+)
- RLS — database-level row isolation by organization; cross-tenant data access is structurally impossible
- Rate limiting — all endpoints rate-limited by plan tier; no single key can exhaust shared resources
Roadmap
- SOC 2 Type I — targeted Q3 2026
- Biometric-bound approval flows — targeted Q3 2026
GDPR & Privacy
ImaRobot is GDPR-compliant. EU customers can:- Access their data — email privacy@imarobot.ai
- Delete their data — we’ll process deletion within 30 days
- Export their data — available on request
- Object to processing — contact us and we’ll respond within 72 hours