Your API Data Belongs on Your Machine, Not Someone Else's Cloud
Three storage modes: local (nothing leaves your machine), git (plain files in a repo you own), or cloud sync (encrypted on your device before it leaves). AES-256 at rest, OS keychain integration, RBAC, and audit logging.
Privacy by Architecture, Not by Policy
Most API tools promise privacy in their terms of service. RESTK enforces it through architecture. When your data never leaves your machine, there is nothing to breach.
Local-First Storage
All your API data — collections, environments, request history, test scripts — is stored in a local database on your machine. Nothing is sent to external servers by default. You own your data completely.
Encrypted at Rest
Your local database is encrypted using AES-256 encryption. Encryption keys are stored in your operating system keychain (macOS Keychain, Windows Credential Manager, or Linux Secret Service), never in plain text on disk.
Optional Cloud Sync
When you choose to sync, values are encrypted on your device before they leave your machine, using managed encryption. Values you mark as secret are never synced at all. Local and git workspaces keep your data off our servers entirely.
GDPR Compliant
RESTK is designed for GDPR compliance by architecture. We collect minimal telemetry (which you can disable), support data export and deletion requests, and store data in regions you specify for cloud sync.
The critical distinction is between privacy by policy and privacy by architecture. A cloud-first tool can promise not to read your data, but the data still sits on their servers. A breach, a subpoena, a change in terms of service, or an employee with the wrong access level can expose everything. When data does not exist on external servers, none of these risks apply.
RESTK's privacy model is simple: your data is on your machine by default. If you choose to enable cloud sync, the data is encrypted on your machine before transmission. The encryption key never leaves your device. RESTK's servers store encrypted blobs that are meaningless without your local key. This is not a marketing claim — it is a mathematical guarantee enforced by cryptography.
Security That Goes Beyond the Basics
Real security is not a feature checkbox. It is a comprehensive approach to protecting every layer of your API workflow.
Encryption at Rest and in Transit
Auth credentials, header and parameter values, request bodies, and environment variable values are encrypted on your device (AES-256-GCM) before they sync. Your local database is AES-256 encrypted, with keys held in your OS keychain. Cloud sync uses managed encryption.
OS Keychain Integration
Sensitive values like API keys, OAuth tokens, bearer tokens, and environment secrets are stored in your operating system's native secure storage. On macOS, this is Keychain. On Windows, the Credential Manager. On Linux, the Secret Service API. These are the same systems your OS uses to protect its own credentials.
Role-Based Access Control
For teams using cloud sync, RESTK provides granular role-based access control. Define who can view, edit, execute, or administer specific collections and environments. Prevent junior developers from accessing production credentials while giving them full access to development workspaces.
Audit Logging
Every meaningful action in a team workspace is logged: who created a request, who modified an environment variable, who executed a request against production, who changed permissions. Every AI action is logged too — the real value next to what the agent actually saw, so you can verify exactly what was sent.
How RESTK Handles Sensitive Data
API testing inherently involves working with sensitive data. Authentication tokens, API keys, OAuth credentials, webhook secrets, and sometimes even personally identifiable information in request or response payloads. How your API tool handles this data is not a minor detail — it is a fundamental security concern.
RESTK classifies data into two categories: workspace data (collections, requests, folder structure, test scripts) and secrets (API keys, tokens, passwords, certificates). These categories are handled differently at every layer.
Workspace data is stored in the local encrypted database and can optionally be synced via encrypted cloud sync. Secrets are stored in your operating system keychain and are never included in cloud sync — in any mode, with no opt-in that changes it. This means that even if someone gains access to a synced workspace, they do not get the keys to your kingdom.
When you share a collection with a team member, RESTK automatically strips secret values and replaces them with variable references. The receiving team member configures their own secret values locally. This pattern — shared structure with local secrets — gives you the collaboration benefits of cloud-based tools with none of the secret exposure risk.
For teams that need to share secrets (such as a shared staging API key), RESTK supports encrypted secret sharing through a separate, audit-logged channel. Every access to a shared secret is logged, and secrets can be rotated or revoked centrally.
How RESTK Compares on Privacy and Security
A transparent comparison of privacy and security capabilities across API testing tools.
| Feature | RESTK | Postman | Insomnia |
|---|---|---|---|
| Local-first data storage | |||
| Git mode (workspace as plain files) | |||
| OS keychain integration | |||
| Works without account | |||
| Variable values never sent to AI | |||
| Granular RBAC | |||
| Audit logging | |||
| Secrets never synced or committed |
The comparison is stark because the architectural decisions are fundamentally different. Postman and Insomnia adopted cloud-first models where data lives on their servers and local storage is either unsupported or deprecated. This means features like a genuinely offline mode, a git-backed workspace, and OS keychain integration are either impossible or extremely difficult to retrofit.
RESTK started with local-first as the foundation and built cloud features on top of that. This is why privacy and security features that would require fundamental re-architecture in other tools are natural extensions of RESTK's existing design.
Our Security Principles
The commitments that guide every security decision we make at RESTK.
Your data is yours
We will never mine, analyze, or monetize your API data. We will never train AI models on your workspace content. We will never sell aggregated insights about your API usage. Your data exists to serve you, not us.
Local by default, cloud by choice
Every feature in RESTK works without a cloud connection. Cloud sync is always opt-in, always encrypted, and always reversible. You can delete all cloud data at any time and continue working locally without losing anything.
Managed encryption when syncing
Cloud sync encrypts values on your device before they leave it, and nothing on the sync path decrypts them, using managed encryption. If you need a mode where our infrastructure is not involved at all, local and git workspaces keep your data entirely off our servers.
Documented, including the boundaries
Our security architecture is documented publicly. Where a protection has a limit, that limit is stated alongside it rather than left for you to discover. If you find something described inaccurately, tell us and we will correct it.
Minimal data collection
We collect only what is necessary to provide the service: crash reports (opt-in), basic usage analytics (opt-in), and account information for cloud sync users. You can disable all telemetry and still use every feature.
Ready for API testing you can trust?
Download RESTK and experience an API tool built with security and privacy as the foundation, not an afterthought.