Zero-Retention Architecture · Independent Tool

Privacy Policy, Security & Legal Notice

Transparent disclosure of how UrbanStock DGII RNC API operates, why we do NOT store user queries, RNCs, or Cédulas on servers or browser disk, and the exact scope of tax validations.

1 · OPERATOR & LEGAL CONTACT

Who operates this platform?

This service is operated by UrbanStock POS as a 100% free, open public infrastructure utility for Dominican businesses, accountants, POS integrations, and developers.

Support & Privacy Contact: soporte@urbanstockpos.com
Official Website: urbanstockpos.com
Independent Status: UrbanStock RNC is a private software utility and is NOT affiliated with, endorsed by, or an official portal of the Dominican tax authority (DGII).

2 · ZERO QUERY STORAGE

We do NOT store searched RNCs, Cédulas, or user histories

Server & API Logs

Zero query database: RNCs, Cédulas, legal names, NCFs, QR URLs, and 606 batch payloads are NEVER recorded in databases or analytics tables.
Normal HTTP query logging is disabled (LOG_HTTP_ALL=false) so successful requests produce zero log lines containing tax IDs.
Automated URL redaction: even if an unexpected server error (5xx) or slow-request alert occurs, IDs and query strings are automatically masked as [REDACTED].

Your Browser (localStorage & Cookies)

Searched RNCs and Cédulas are NEVER persisted in browser localStorage, disk cache, or tracking cookies (safe on shared POS/office PCs).
The quick 'This tab' pills live strictly in volatile tab RAM, include an instant Clear button, and vanish completely when closing or refreshing the tab.
The only value saved in localStorage is your Dark/Light visual theme choice (us-rnc-theme). Zero behavioral cookies are used.

3 · DATA PROVENANCE & SECURITY CONTROLS

Public DGII Source, TLS Security & Anti-Abuse Protections

Public Data Origin: All taxpayer records come strictly from the official daily public files published by DGII at dgii.gov.do (RNC_CONTRIBUYENTES.zip and DGII_RNC.zip). Sync dates and dataset versions are published transparently at /api/v1/meta.
Transport & HTTP Hardening: Served over HTTPS/TLS in production with nosniff, SAMEORIGIN framing protection, strict Referrer-Policy, Permissions-Policy, and a 32 KB max request body limit.
Abuse & Scraping Defense: Open browser CORS (*) is backed by real server-side per-IP rate limiting (120/min lookup, 40/min search, 20/min batch), an automatic 5-minute cooldown block (HTTP 429) on repeated violations, a strict 25-result cap on name search (no bulk dump), and ephemeral rate-limiter memory only.
Safe Sandbox Testing: Developers should test integrations with 000000000 (RNC), 00000000000 (Cédula), or EMPRESA DE PRUEBA without sending real third-party tax IDs.

4 · LEGAL DISCLAIMER & FISCAL SCOPE

Difference between Registry / Structure Validation and Official DGII Authorization

An ACTIVO taxpayer record and mathematically valid Module 11/10 check digit or NCF/e-CF sequence confirm catalog status and structural syntax — they do NOT certify that an individual invoice sequence was actually issued/authorized on DGII servers, nor do they replace official JCE identity verification.
For definitive legal validation of tax receipts or electronic fiscal stamps (e-CF), always consult DGII directly at dgii.gov.do or use the extracted dgiiVerification.timbreUrl directly in your browser. See also our Terms of Use and Why We Built This.
Advertising & Analytics Note: No ad tracking cookies are currently active on this tool. If optional privacy-compliant analytics or advertising (such as Google AdSense) are added in the future, this policy will be updated with clear cookie and consent disclosures before activation.