Built for teams that can't leak data
Simulation data is often sensitive IP. SimAPI is designed to touch as little of it as possible, keep keys safe, and run inside your own perimeter when you need it to.
API keys, hashed at rest
Keys are shown once at generation, then stored only as a SHA-256 hash. Send them via the X-API-Key header over TLS; rotate or revoke any key instantly.
Encryption in transit
All API traffic is HTTPS/TLS 1.2+. Validation is stateless — request payloads are processed and not persisted beyond the ephemeral job TTL.
Self-hosted & VPC options
The engine is a container you can run in your own VPC or air-gapped network. On Enterprise, simulation data never leaves your infrastructure.
Least data, by design
The deterministic engine needs only numeric columns. Non-numeric fields are dropped on ingest; nothing is stored to train shared models.
Auditable & reproducible
Every verdict is deterministic and cites the exact check, value, and bound it violated — a defensible audit trail, not a black box.
Access controls (Enterprise)
SSO, role-based access, and audit logs for teams that need them. Security review and a DPA available on request.
Reporting a vulnerability. Email security@sim-api.dev or open a private advisory on the GitHub repo. We aim to acknowledge within one business day. SOC 2 Type II is on the roadmap for Enterprise.
Put a quality gate in front of every simulation run.
Generate a key, validate a sample run in the browser, then move the same checks into your CLI, SDK, or CI pipeline.