Enterprise Search Infrastructure
How Tavily Cleared the
Vendor-Review Bar for Search APIs.
In February 2026, Nebius announced it would acquire Tavily for up to $400M. Six months later, in July, Tavily earned ISO 27001 certification, and its search suite grew into a five-tool lineup: Search, Extract, Crawl, Map, and Research. Being "fast" and "cheap" was never enough to clear a corporate procurement review — here's what finally worked.
The Bottleneck
Stuck at procurement,
before precision even mattered
A search API's quality was never decided by benchmarks alone.
When teams wire an external search API like Tavily into an AI agent, the first gate isn't accuracy or latency — it's whether IT security and legal will clear the vendor. Tavily launched with a three-tool core of Search, Extract, and Crawl, and in that setting, the lack of a third-party security certification often became the sticking point that stalled adoption.
The turning point was Nebius's announcement on February 10, 2026 that it would acquire Tavily. The base deal was reported at $275M, rising to as much as $400M with milestones — and joining an AI infrastructure company meant Tavily now had to act less like a standalone startup API and more like a piece of enterprise infrastructure.
What Changed
ISO 27001, and the
expansion to five tools
The security certification and the new endpoints look like separate events, but they share the same root: becoming search infrastructure enterprises can actually run on.
Tavily officially announced it had earned ISO/IEC 27001 certification, rounding out a three-part security posture alongside its existing SOC 2 Type II certification and zero data retention by default. That gives legal and IT teams a concrete, third-party-audited answer to the question they care about most: where does our data actually end up?
The search suite itself has also grown. On top of the original Search, Extract, and Crawl, Tavily added Map, which discovers a site's link structure as a graph, and Research, which reached general availability in January 2026. The official SDK now describes the product as offering "search, extract, crawl, map, and research functionalities" — five in total. Research lets you pass a model of mini, pro, or auto, and an output_schema to get back a structured report conforming to a JSON Schema — instead of a single search, it runs multiple searches and extractions internally and returns a cited report in one call.
By the Numbers
The expansion, in figures
How Research Works
What actually happens
inside a Research call
Behind one API call, Tavily assembles multiple searches and extractions automatically.
Just pass an input
Choose mini, pro, or auto for the model. Auto picks a strategy based on task complexity, so you can hand off the decision when you're unsure.
Multiple searches run automatically
How many searches and extractions actually run depends on the task. Mini spends 4-110 credits, pro spends 15-250 — that wide, hard-to-predict metering is the operational headache.
Comes back as a cited report
Pass an output_schema and you get structured output matching a JSON Schema; for longer tasks you can stream progress updates as they happen.
The search API race has shifted from raw accuracy to "can it clear procurement."
Who It Helps
Who actually benefits
This shift lands harder in organizational deployments than for solo builders.
Engineers running the security review
Being able to point to ISO 27001 and SOC 2 Type II lets you fill in the "third-party certification" line on a vendor assessment sheet without building the case yourself. Zero data retention by default also shortens DPA negotiations.
Business owners writing the budget case
"ISO 27001 certified" carries more weight in an internal approval memo than "high search accuracy." The catch: the benefit mostly applies to organizational rollouts — solo builders and side projects won't feel much difference.
Engineers designing crawl strategy
Instead of firing Crawl at an entire site up front, Map lets you learn the link structure first. That cuts wasted page fetches and makes it easier to design a downstream RAG index.
Where It Stands
Where Tavily sits in the field
Tavily isn't the only option — different tools fit different jobs.
| Other search / research APIs | Tavily (as of 2026.08) |
|---|---|
| Exa — strong at semantic search and find-similar | Five endpoints spanning search through structured reports |
| Brave Search API — independent index, cited as faster in some comparisons | LLM-ready formatted responses, 1,000 free credits every month |
| Serper — wraps Google results, strong on freshness and track record | Research runs multiple searches/extractions internally in one call |
| Many SERP-style APIs stop at SOC 2 | ISO 27001 + SOC 2 Type II + zero data retention by default |
What's Next
Don't over-trust it,
but don't ignore it either
ISO 27001 certifies an information security management system — it does not guarantee an uptime SLA or how fast individual vulnerabilities get patched. Research's usage-based pricing is also left to the model's discretion: mini runs 4-110 credits and pro runs 15-250, a wide enough range that cost forecasting is harder than with plain Search. Some comparisons put independent-index players like Brave Search API ahead on raw speed, so Tavily's edge on accuracy and speed isn't absolute either.
Before adopting Tavily for an enterprise use case, three things are worth checking first: (1) pull the actual ISO 27001 certificate scope and the SOC 2 Type II audit report rather than taking the announcement at face value; (2) estimate expected Research credit consumption against your own use case before picking a plan; and (3) use Map to narrow the crawl target before running Crawl, so fetch costs are bounded by design rather than after the fact.