Trust & procurement

Last updated: October 18, 2026

A one-page summary for business buyers and security reviewers: who runs Fairquery, how each tool keeps (or doesn't keep) your data, limits, versioning, support and the third parties involved. It describes current practice, not a contract; the Terms of Service govern use. The detailed per-tool data flows are on Security & Privacy.

At a glance

• Who: Fairquery is a small, independent tools brand run by a single operator. There is no larger team, office or support desk behind it.
• Certifications: none. Fairquery has no SOC 2, ISO 27001 or similar certification and doesn't claim one. Paid runs execute on Apify; see Apify's own security and compliance pages for the platform.
• SLA: none. Tools are provided as described in the Terms, without an uptime or response-time guarantee. Response targets below are targets, not commitments.
• Source code: public on GitHub under the MIT License for the Actors, MCP servers and the VS Code extension. You can read exactly what each tool does before you run it.
• Data: free tools run on your machine. Paid tools run in your Apify account with your token, so run data stays under your account's settings. We don't sell inputs or results and don't use them to train AI models.

Data retention by tool

You can delete run storages and named stores at any time in Apify Console or through the Apify API. Per-tool details, including what each tool sends to which third-party host, are on Security & Privacy.

Limits, quotas and spend control

• Per-run caps: every Actor has an input cap you can lower (for example maxNames, maxEmails, maxDocuments, maxPackages, maxDomains, maxSites). The current defaults and maximums are on each Actor's Input tab in the Apify Store, which is the authoritative source.
• Spend cap: you can set a maximum cost per run in Apify's run options, and Apify won't charge more than that for the run. There are no subscriptions or minimums on Apify.
• MCP calls: MCP tools state their per-call limits (documents, characters, items) in their descriptions and schemas; input over a limit is rejected or returned as a named error row.
• Upstream politeness: tools throttle themselves against public sources, for example at most 5 requests per second to SEC EDGAR, and the tools that crawl websites are designed to respect robots.txt (details per tool on Security & Privacy). A source's own rate limits can slow a run; they never raise your price.
• RapidAPI: quotas and rate limits are set per plan on each RapidAPI listing, including a free tier.

Versioning and changelogs

• MCP servers and npm packages use semantic versioning: patch releases change wording or fix bugs, minor releases add tools or optional parameters without breaking existing calls, and a major release is used for anything that removes or renames a tool, parameter or output field.
• Each repository keeps a changelog (CHANGELOG.md, or mcp/CHANGELOG.md for an Actor's MCP server) and MCP server versions are published as GitHub releases with notes.
• Apify Actors are rebuilt in place; the Store page always runs the latest build. We aim to keep output changes additive, and prices are shown on each Store page before you run.

Support

• Email info@getfairquery.com, open an issue on the tool's GitHub repository, or use the Issues tab on the tool's Apify Store page.
• Target: a first reply within 3 business days. This is a target for a one-person operation, not an SLA.
• Security reports follow the separate process and targets on Security & Privacy (also security.txt).
• Platform status: Fairquery has no status page of its own. Paid runs depend on Apify (status.apify.com) and RapidAPI listings on RapidAPI (status.rapidapi.com).

Dependencies and releases

• Repositories commit their lockfiles, and CI installs with npm ci and runs the tests on every push.
• Runtime dependencies are listed in each package.json. You can produce a software bill of materials (SBOM) for any package yourself with npm sbom --sbom-format cyclonedx, or ask us for one.
• The npm packages (@fairquery/agent-trust-mcp, @fairquery/company-jobs-feed-mcp) are published from the Fairquery npm account. They don't carry npm provenance attestations yet.
• No repository or package contains credentials. MCP servers read your APIFY_TOKEN only from the environment, and only when a paid tool needs it.

Third parties involved

Security questionnaires

Send security questionnaires or vendor forms to info@getfairquery.com. We answer them from what is on this page, Security & Privacy and the public source code, and we won't claim controls we don't have.