PLATFORM/SECURITY
Security.
Market data is public at the source. The things we protect are your keys, your account, what you query and the integrity of the archive. This page describes how, where we are on SOC 2, and how to report a problem.
At restAES-256AWS KMS
In transitTLS 1.2+1.3 preferred
SOC 2 Type I2027in preparation
Report response2business days
Encrypted everywhere it is stored or moved.
- All storage, including the raw and normalized archive, capture host disks and backups, is encrypted at rest with AES-256 using AWS KMS keys held per region. Keys rotate every year.
- Every public endpoint (
api.financedatacloud.com,stream.financedatacloud.com, the website) requires TLS 1.2 or later, prefers TLS 1.3 and sends HSTS. - Traffic between Tokyo, Ireland and N. Virginia runs over encrypted links. Nothing crosses a region in plain text.
- Raw captured messages are written to storage with object lock, so they cannot be altered or deleted within the retention period, by us or by anyone else.
Few people, narrow permissions, everything logged.
- Staff sign in through single sign-on with hardware security keys. There are no shared accounts and no passwords on production systems.
- Production access uses short-lived credentials that expire after one hour. Every session and command is logged to a separate account that the engineers on call cannot modify.
- Capture, archive and customer delivery run in separate cloud accounts, so a problem in one cannot reach the others.
- Infrastructure changes go through reviewed pull requests, with a second engineer approving every change to production.
- We review access every quarter and remove it the same day someone's role changes.
- Customer S3 access is a read-only, cross-account grant scoped to the datasets and venues you license, and it is removed when a contract ends.
Keys you can scope, rotate and revoke.
- Live keys start with
fdc_live_and test keys withfdc_test_, so a leaked key is easy to recognize. Test keys return only a 24-hour sample. - A key is shown once, when it is created. We store a salted hash, never the key itself, and cannot recover a lost key.
- Each key can be scoped to specific datasets, venues and access methods, such as read-only S3 or stream-only.
- Desk and Enterprise keys can be restricted to an IP allowlist.
- Each account can hold up to 10 active keys at once, so you can rotate without downtime. Revocation takes effect within seconds on REST and closes open WebSocket sessions.
- We scan public code repositories for the
fdc_live_prefix. Any key we find is revoked, and the owner is told.
What we keep about you, and what we don't.
- We keep account details, contract and billing records, and API usage logs. Usage logs are kept for 13 months, then deleted.
- Card payments go through our payment processor. We never see or store card numbers.
- We do not see your trading activity, and we never share which datasets, venues or symbols you query with anyone.
- Participant identifiers in L4 data are passed through as the venue supplies them, which on Hyperliquid means on-chain addresses. We do not try to tie them to named people.
- Customer data is stored in the regions we operate: Tokyo, Ireland and, from Phase 2, N. Virginia. Our cloud provider is our main subprocessor; the full list is available on request.
- We delete account data within 30 days of a verified request, except records we must keep by law. Write to chris@financedatacloud.com.
Patching, monitoring and on-call.
- Operating system and dependency updates are applied within 14 days; critical security patches within 72 hours. Capture hosts are patched one region at a time so the other region keeps recording.
- Dependencies are scanned for known vulnerabilities on every build. The
fdcPython package is published with signed releases. - Monitoring covers every collector, the merge and storage. On-call follows the sun across New York, London, Lisbon, Berlin and Singapore.
- An independent firm will run a penetration test of the API and delivery infrastructure before Phase 1 early access. Enterprise customers can read the summary under NDA.
- Incidents that affect data are published on the status page and recorded in the
gapstable where relevant.
SOC 2 Type I, targeted for 2027.
We are preparing for a SOC 2 Type I audit covering security, availability and confidentiality, with the audit targeted for 2027. Our policies are written and our controls are mapped to the criteria. A Type II observation period starts once Type I is issued. Until the report is available, we answer security questionnaires directly and can walk your team through our controls.
Reporting a vulnerability.
Email daniel@financedatacloud.com with a description, the steps to reproduce it and the impact you see. A PGP key is available on request.
01Acknowledgement within 2 business daysA named engineer replies and stays your contact until the report is closed.
02Assessment within 5 business daysWe confirm whether we can reproduce it and how severe we think it is.
03FixCritical issues within 7 days, high within 30, others within 90. We keep you informed as it progresses.
04Coordinated disclosureWe ask for 90 days, or until a fix ships if sooner, before details are published. With your permission, we credit you.
In scope
financedatacloud.comand its subdomains- The REST API and WebSocket stream
- S3 delivery and cross-account grants
- The
fdcPython package
Out of scope
- Denial of service and load testing
- Social engineering and physical attacks
- Third-party services we use
- Reports from automated scanners without a working proof
We will not take legal action against anyone who reports in good faith, avoids privacy violations and service disruption, and does not access data beyond what is needed to show the issue. We do not run a paid bug bounty yet.
Review us before you sign.
We answer security reviews directly while SOC 2 is in preparation. Pre-register, or write to our founder and we will set up a call with the engineer who owns the control.
EARLY ACCESS · PRE-SALE PRICINGPre-register for early access → DANIEL GARCIA · CEO & FOUNDERdaniel@financedatacloud.com →