Terms of use

_Last updated: 2026-09-04. Applies to the hosted API and MCP server at api.foretak.dev and to the registry-mcp / brreg-mcp packages._

These terms are short on purpose. If something here is unclear, ask before you build on it.

What this service is

registry-mcp reads public national business registers and returns what they say, in one shape, over a REST API and an MCP server. It adds no facts of its own. Filing deadlines are the one thing it *computes* rather than reads — see [Computed deadlines](#computed-deadlines) below.

This service does not perform sanctions, PEP or adverse-media screening, and it does not verify bank account details. It returns identity and filing data from the national register only; do not treat a successful lookup as a compliance clearance or a confirmed payment detail.

Where the data comes from

Norwegian data comes from Enhetsregisteret, published as open data by Brønnøysundregistrene, under the Norsk lisens for offentlige data (NLOD) 2.0.

Every response we return carries source, source_url and license so the attribution travels with the data.

NLOD requires attribution, and that obligation passes to you. If you republish, display or redistribute this data, credit Brønnøysundregistrene as the source — for example:

> Contains data from Enhetsregisteret, Brønnøysundregistrene, under NLOD 2.0.

We are not affiliated with, endorsed by, or acting on behalf of Brønnøysundregistrene, Skatteetaten, or any other authority named in a response.

British data comes from the Companies House public register, api.company-information.service.gov.uk. Register information is made available under section 47 of the Copyright, Designs and Patents Act 1988 and Schedule 1 of the Database Regulations (SI 1997/3032); Companies House states it imposes no rules or requirements on how public register information is used. We credit it as "Crown copyright — Companies House public register, free to re-use" in every response, even though the register data carries no attribution obligation, because a citation is what makes an agent's answer checkable. We are not affiliated with, endorsed by, or acting on behalf of Companies House.

Swedish data comes from Bolagsverket's "värdefulla datamängder" (high-value datasets) API, gw.api.bolagsverket.se, accessed with our own OAuth 2 client credentials. Bolagsverket states that no agreement is required to use the API and that the data may be used freely for commercial and non-commercial purposes; Bolagsverket names no licence, so neither do we — our licence field reads "Free re-use (Bolagsverket/SCB high-value datasets, EU Open Data Directive) — the publisher names no licence". We are not affiliated with, endorsed by, or acting on behalf of Bolagsverket.

Where a register marks an entity as protected against direct marketing (advertising_protected: true), that marking is a condition of our passing the record on, and of you passing it on further. Keep it with the contact details: do not use or forward email, phone or an address from such a record for direct-marketing purposes, and do not strip the corresponding notes sentence when you relay the record.

No warranty

The service is provided as is, with no warranty of any kind, express or implied — including accuracy, completeness, timeliness, or fitness for a particular purpose.

Concretely:

• Responses may be stale. We cache upstream responses for up to 24 hours, and the register itself lags real-world events.
• A field the register does not publish comes back as null, meaning "we do not know" — never "no".
• Field mappings, English labels and derived flags are our interpretation of the register's data and may be wrong.
• The register itself can be wrong or out of date. We reproduce it; we do not correct it.

For anything that carries legal or financial consequence — paying an invoice, signing a contract, a KYC or AML decision, a filing — verify against the official register before you act. The authoritative source is data.brreg.no, and every response gives you the source_url to check.

To the fullest extent permitted by law, we accept no liability for any loss arising from use of this service or reliance on its output.

Computed deadlines

company_deadlines and /v1/{country}/company/{id}/deadlines compute dates from statutory rules and the entity's registered attributes. They are an estimate, not a notice from an authority.

They assume a calendar-year accounting period — the register does not publish which companies have a deviating one (*avvikende regnskapsår*), so a company that does will have different real dates. Each deadline states its assumption in applies_because, and each report repeats the caveat in notes. Every computed Norwegian deadline also names its own statutory basis in applies_because; two of the six — the annual accounts filing and the ordinary general meeting — deliberately never move off a weekend or public holiday, because the law behind them has no rule that would allow it. Read them before quoting a date to anyone.

Deadlines are not tax, accounting or legal advice.

Rate limits and fair use

• 60 requests per minute per IP on the hosted API. Exceeding it returns 429 rate_limited; back off and retry rather than retrying immediately.
• Cache on your side. A response is good for a day for almost every purpose, and we already cache upstream for 24 hours.
• Do not bulk-download the register through this service. Brønnøysundregistrene publishes complete datasets for that, and using them is faster for you and kinder to everyone: <https://data.brreg.no/enhetsregisteret/oppslag/enheter>
• Set REGISTRY_MCP_CONTACT_EMAIL when self-hosting. It goes into the User-Agent we send upstream, which is what the register asks of API clients; anonymous clients may be throttled or blocked at their end.
• We may throttle, block or withdraw access to protect the service or to comply with the upstream register's terms. The hosted endpoint is a convenience, not a commitment — it may change or go away. Self-host if you need a guarantee; the code is MIT licensed.

Personal data

Business register data is public, but some of it is about people — for example a sole proprietorship (*enkeltpersonforetak*) whose registered name is a person's name, or contact details registered by the entity.

Where a UK company has a registered charge, parties_entitled, assets_charged and obligations_secured are the fields a natural person's name is most likely to reach a response through — a director lending to their own company, a guarantor, or an occupant named in a property description — because those fields relay the register's own free text about the charge, verbatim; and ParentBlock.legal_name is a fourth such field, a corporate parent's name as GLEIF publishes it, person-bearing only where the parent itself is a sole proprietor.

We do not create profiles, enrich, or combine this data with any other source, and we log only what is needed to run and monitor the service. If you process this data further, you are the controller for that processing and the GDPR obligations are yours, not ours.

For a request concerning personal data in a register record, contact the register directly — we cannot change what Enhetsregisteret publishes. For anything concerning this service's own logs or cache, write to us.

Your code, our code

This project's source code is MIT licensed (see [LICENSE](../LICENSE)). The MIT licence covers the software. It does not cover the register data, which is governed by NLOD 2.0 as described above.

Changes

These terms may change; the date at the top says when they last did. Material changes will be noted in the repository's release notes.

Contact

hello@foretak.dev

Bugs and corrections are better as issues: <https://github.com/foretak/registry-mcp/issues>