Privacy — ContrastAPI Dify Plugin

What this plugin does

The ContrastAPI plugin makes HTTPS calls to https://api.contrastcyber.com/v1/* on your behalf. It does not cache, store, log, or relay your data anywhere else. It does not require credentials. It runs entirely inside your Dify instance.

What the upstream API stores

Field	Description	Purpose
`client_ip`	HMAC-SHA-256 hash of your IP (truncated, salted)	Anonymized rate limiting
`endpoint`	Endpoint category only — path parameters stripped (e.g. `/v1/domain`, never `/v1/domain/example.com`)	Aggregate usage analytics
`called_at`	Timestamp	Sliding-window rate limiting
`key_hash`	SHA-256 of Pro API key (only if used)	Pro tier billing

What the upstream API does NOT store

Query values — domain names, IPs, CVE IDs, hashes, emails, phone numbers, URLs, and source code are processed in memory and discarded after the response is returned.
Response contents — not logged.
Personal identifiers — no name, no email, no account. Key-less use requires no signup.
Cookies, fingerprints, third-party analytics — none.

Password check — special case

The password_check tool SHA-1 hashes the password inside the plugin process before any network call. The plain-text password never leaves the Dify host. The upstream API performs a k-anonymity range query against HIBP server-side.

See DATA_HANDLING.md for the full threat model and trust boundary analysis.

Transparency endpoint

Verify what the API stores about you in real time:

curl https://api.contrastcyber.com/v1/privacy/my-data

Privacy controls

DNT: 1 or Sec-GPC: 1 headers → no usage row is written at all
Raw nginx logs rotate every 24 hours; path parameters are redacted before logging
Hashed IPs are anonymized to empty after 90 days

Self-hosted deployment

The entire service is MIT-licensed: https://github.com/UPinar/contrastapi. Point the plugin's API_BASE at your own host for full network isolation.

ContrastAPI privacy policy