Privacy

SourcePost is a directory of suppliers and services for AI agents. It has no user accounts, sets no cookies, except the administrator's own session at /admin, and does not use third-party analytics.

What is recorded for each request

To measure how SourcePost is used (which kinds of clients come, what they search, which searches find nothing) and to protect the service, each request is recorded with:

date and time (UTC), method, path and query string (this includes the search text);
response status and number of listings returned;
user agent, response language and an estimated client type (crawler, agent, human, scanner, automated or unknown);
client_hash: a code computed from the network part of the IP address (IPv4 /24, IPv6 /48), the date and a secret key.

The IP address is never stored in these records. client_hash changes every day: it lets SourcePost count distinct clients within a day, but it cannot be turned back into the IP address and it cannot follow a client from one day to the next. Requests to /health (service monitoring) are not recorded.

MCP server

SourcePost also offers an MCP server at https://sourcepost.dev/mcp, with the same functions as the API (search listings, see one listing, send a message). Each call is recorded like any other request, as described above; for a call to a tool, the record also says which tool it was, and for a search, the search text. The name and version of the MCP client are not stored, and no other data is kept. Messages sent with the send_interest tool are stored like those sent to POST /v1/interest (see below).

Server security logs

Separately, the server keeps technical security logs: SSH access attempts, connections blocked by the firewall, serious errors of the web server and system messages. These logs may include IP addresses. They are used only to protect and maintain the server, are kept for 30 days at most and are then deleted automatically.

How long it is kept

Request records are kept for 90 days and then deleted automatically (SourcePost deletes older records every hour).

Backups: the server is backed up every day by the hosting provider. Backups keep the data up to 7 more days, after which they are deleted automatically. In addition, before each update of SourcePost a copy of the database is kept on the server itself; these copies are deleted automatically after 7 days at most.

Messages sent to `POST /v1/interest`

Agents can tell SourcePost what they offer or what they could not find. SourcePost stores the type of message (offer or missing), the text, the optional contact_url and the date. The message is stored without IP address or user agent (the request itself is recorded like any other, as described above). Messages are read by the SourcePost team and are not published. Please do not include personal data in them.

These messages are kept for 365 days (12 months) and then deleted automatically, in the same automatic deletion.

Request limits

To prevent abuse, each client can make 60 requests per minute, and send 10 messages per hour to POST /v1/interest. To count them, the IP address (IPv6: its /64 network) is kept only in memory while the count is needed, and discarded afterwards (or when the service restarts); it is never written to disk.

Hosting and third parties

SourcePost is hosted by DigitalOcean (DigitalOcean, LLC, a company based in the United States), on a server in a data centre in the European Union (the Netherlands). DigitalOcean also keeps the backups described above.

SourcePost does not load any resource from third parties: every page and file, including the API documentation at /docs, is served by SourcePost itself.

Contact

For any question about privacy, write to contact@sourcepost.dev. As the request records contain no IP addresses, SourcePost usually cannot link them to a person.

Last updated: 2026-10-31.

Data controller

Name: Miguel Rojas
Address: Palencia, España
Tax ID: IdentifiCacion
Contact: contact@sourcepost.dev