--- title: "Trust center" description: "UAE Data trust center: live API status and data freshness, data sources and methodology, security practices, versioning policy and changelog." canonical: "https://uae.data.evoost.ai/trust" last_updated: "2026-10-25" --- # Trust center UAE Data trust center: live API status and data freshness, data sources and methodology, security practices, versioning policy and changelog. ## Live status - API (https://uae-data-api.evoost-ai.workers.dev/v1/health): operational, 102 ms round trip from our web server; checked 25 Oct 2026, 19:34 UTC - Ingestion measured 25 Oct 2026, 19:34 UTC: 9 of 14 active sources delivered data in the last 24 h; 31,937 listing pages fetched and 30,912 usable rows ingested in 24 h. - Most recent source fetch: 25 Oct 2026, 19:34 UTC ## Data sources and methodology - **What the data is**: Asking prices and asking rents from live property listings, not completed transactions. Official Dubai Land Department open data (registries) is offered separately and is not mixed into listing statistics. - **Sources**: Listings are collected from major UAE property portals and developer sites, then normalised, de-duplicated across sources and quality-scored before they reach the API. - **Rents**: Rents quoted daily, weekly or monthly are normalised to a yearly figure; rents with an unknown or implausible frequency are excluded from rent statistics. - **Gross yields**: Median yearly asking rent divided by median asking sale price for the same area, property type and bedroom count. A segment needs at least 5 sale and 5 rent listings; yields outside 1-12% are hidden as likely data errors. Confidence: high with 20+ listings on each side, medium with 10+, otherwise low. - **Price cuts**: A listing counts as reduced when its current asking price is 1-30% below the first asking price our pipeline observed; larger moves are excluded as likely data errors. Days on market are counted from our first observation, not the portal's listing date. - **Freshness**: Sources are re-crawled continuously; every response carries generated_at, and statistics are rebuilt from the latest data by scheduled jobs. ## Security practices - **API keys are stored hashed**: Keys are shown once at creation; the API stores and looks them up by their SHA-256 hash, never the key itself. Keys can be rotated or revoked instantly from the dashboard. - **Platform key stays server-side**: The website and dashboard call the API through server functions; the platform key is read from a server environment variable and never reaches the browser. Data paths are allow-listed, so customers cannot reach platform endpoints. - **OAuth for the MCP server**: The app's MCP server requires an OAuth access token; tools act as the verified token subject, with that user's plan and quota. Identity is never taken from tool input. - **Signed, short-lived export links**: Bulk-export downloads use HMAC-signed links that expire after 120 seconds; files are streamed with the platform key server-side and never pass through the browser's JSON proxy. - **Rate limiting on every request**: Authenticated calls are limited per account by plan (token bucket in a Cloudflare Durable Object) and report RateLimit / RateLimit-Policy headers; public endpoints are limited per client IP. Monthly quotas answer HTTP 429 quota_exceeded. - **Idempotent retries**: Mutating POSTs accept an Idempotency-Key: a retry with the same key and body within 24 hours replays the first response instead of repeating the action; a different body with the same key is rejected. - **Stored idempotent responses are encrypted**: Replayed responses can contain freshly issued key secrets, so they are stored AES-GCM encrypted; without the encryption key the API refuses the Idempotency-Key header rather than storing plaintext. - **Listing contact details redacted by default**: Agent contact details (PII) are left out of search and batch results and are stored AES-GCM encrypted at ingestion. - **Traceable requests and an audit log**: Every response carries an x-request-id for support and tracing; account, key and plan changes on the platform API are written to an audit log. ## Versioning /v1 changes are additive; breaking changes ship under a new major path with at least 90 days' notice. Policy: https://uae-data-api.evoost-ai.workers.dev/policies/versioning ## Changelog - 2026-10-25 — **Async bulk exports** (API): POST /v1/exports queues CSV or JSONL exports of listings, yields, areas, off-plan and price cuts (Pro and up), with Retry-After polling, 7-day retention and short-lived signed download links in the dashboard. - 2026-10-25 — **Price-cut analytics, CSV export and batch lookups** (API): /v1/analytics/price-cuts reports the share of listings below their first asking price and days on market per area; format=csv on the main datasets; POST /v1/listings/batch fetches up to 50 listings in one request. - 2026-10-25 — **Idempotency keys, RateLimit headers and a versioning policy** (API): Idempotency-Key on mutating POSTs (stored replays are AES-GCM encrypted), IETF RateLimit and RateLimit-Policy headers, and a published /v1 deprecation policy. - 2026-10-25 — **Documentation MCP server and agent discovery** (Agents): A public, read-only MCP server for the docs, OAuth protected-resource metadata, llms.txt, markdown twins of every public page and an agent skill. - 2026-10-25 — **ROI & mortgage calculator and broker market report** (Web app): A free buy-to-let calculator at /tools/roi-calculator and a printable market report in the dashboard, both fed by live yields. - 2026-10-25 — **Activation checklist and in-app Try it** (Web app): First-call snippets and a Try it runner in the dashboard, with progress taken from real API usage. - 2026-10-25 — **OpenAPI JSON and typed errors** (API): /openapi.json alongside the YAML spec, a typed error model on every operation, JSON 404s and JSON 500s. - 2026-10-24 — **3D market maps** (Web app): deck.gl market map for signed-in users (plan-sampled points) and an anonymised landing map; /v1/map endpoints in the API. - 2026-10-23 — **Source operations alerts** (Data): Scheduler alerts when a source circuit opens or ingestion stalls, plus an ingestion health snapshot. - 2026-10-23 — **DLD developer registry** (Web app): Dubai Land Department developer registry in the dashboard, linked to off-plan projects. - 2026-10-22 — **AI agents hub and full MCP toolset** (Agents): Connect Claude, ChatGPT, Cursor, VS Code and Claude Code to the app's remote MCP server (OAuth sign-in); every tool follows the user's plan. - 2026-10-22 — **Investment opportunities v2** (API): Size-aware valuation against comparables, plausibility guards and a richer payload for /v1/analytics/opportunities. - 2026-10-22 — **CSV downloads, watchlist alerts and the live landing showcase** (Web app): Export on-screen rows to CSV, alerts for new and changed listings on saved searches, and live aggregates on the landing page. - 2026-10-21 — **Plans, quotas and the DLD registry API** (API): Free, Starter, Pro and Enterprise plans with monthly quotas and per-minute rate limits, a platform API and Dubai Land Department registry endpoints. - 2026-09-22 — **Off-plan projects** (Data): New-development projects with developer, handover dates and payment plans through /v1/offplan. - 2026-09-17 — **Yields, benchmarks, forecasts and the area leaderboard** (API): Gross rental yields per area, type and bedrooms; price benchmarks with comparables; short-horizon forecasts; and an area leaderboard. - 2026-09-14 — **Price trends and market velocity** (API): /v1/analytics/price-trends and /v1/analytics/market from the listing change history, plus days on market. ## Support Email hello@evoost.ai. Enterprise plans include SLAs, available on request from sales (https://uae.data.evoost.ai/contact).