Security

This page says what WU Capital Limited, which runs Trading Agent Data, does today to protect the service and your information. It describes what is in place, not what we plan. Where something is missing, we say so. Our privacy policy has the full list of the personal information we collect and how long we keep it.

1. What data we hold

• The data we sell — company financial accounts that companies filed with public registers. It is built to hold no personal information: sole traders are left out, and the limits of that are explained in section 5a of the privacy policy.
• Using the data API — you do not upload any data of your own to use it. We receive your requests: your key, the endpoint and what you asked for, and the IP address they come from. We keep request logs that include IP addresses for no more than 90 days (privacy policy, section 5c).
• Accounts and billing — your name, email address, the licence you accepted, and the identifiers Stripe gives us. Card numbers are handled by Stripe and do not reach our systems.
• Portfolio Health Check lists — you send us the list of companies by email. It is not uploaded to our website, our database or Stripe. We use it only to prepare the report, and delete it afterwards unless you ask us to keep it (see the Portfolio Health Check page). We may use AI tools to help prepare the report (privacy policy, section 3).

2. API keys

• A key is shown to you once, when you create it.
• We store a SHA-256 hash of the key and its first 12 characters (so you can recognise it), not the key itself. When a request arrives, we hash the key it carries and look up the hash.
• You can revoke a key at any time in your account. A revoked key stops working at once.
• API use is rate limited.

3. Connections and downloads

• The website and the data API are served over HTTPS only. Plain HTTP requests are redirected to HTTPS, and the site sends a Strict Transport Security (HSTS) header.
• Bulk data files are downloaded through signed links that expire, after 15 minutes or 8 hours depending on the file.
• We publish a SHA-256 hash for our data files so that you can check what you downloaded.

4. Where the service runs

We run no servers or data centres of our own. We use these providers:

• Vercel — the website and the data API. Server code runs in Vercel's US East region (Washington, D.C.).
• Supabase — customer accounts, sign-in and API key hashes, in Singapore.
• Cloudflare R2 — our data files (Eastern North America) and our encrypted database backups.
• Stripe — payments.
• PostHog — usage analytics, in the United States.

The full list of providers, including email, error reporting and the tools we use to build and run the service, is in section 3 of the privacy policy. These providers hold their own security certifications. Those certifications are theirs, not ours.

5. Database backups

Our database provider's plan does not include backups, so we make our own. Since 10 November 2026, a copy of the customer database is taken every night, encrypted before it leaves the job, and stored in a private Cloudflare R2 bucket. After each upload the file is read back and its checksum compared. We keep 30 daily and 12 monthly copies. The key that decrypts them is not stored with the backups, in our source code or in our hosting services.

We have not yet completed a test restore from these backups, and we do not promise a recovery time.

6. Who can access our systems

• Administrative access to our production systems is limited to the company's director. Our source code is in a private repository.
• We use AI tools (Anthropic's Claude) to help build and run the service. They work under the director's accounts (privacy policy, section 3).
• Two-factor authentication is on for our code hosting, email and database accounts (checked 2 November 2026). It is not yet on for every service account we use.
• Our administration pages check an allowlist on the server.
• Production secrets are kept in our hosting and build services' secret stores and on an encrypted company computer. They are never placed in source code or sent to the browser.
• You can turn on two-factor authentication (an authenticator app) for your own account in Account → Security. Once you have, we ask for its code at sign-in.

7. If something goes wrong

We follow a written incident procedure. If an incident affects your information, we will tell you as soon as practicable, and we will notify the authorities where the law requires it, as section 7 of the privacy policy says. We also tell licensees of a security incident affecting their keys or account information, as clause 21.2 of the Data Terms says.

8. What we do not have yet

• No SOC 2 report, ISO 27001 certificate or other independent certification.
• No independent security audit or penetration test.
• No formal business continuity plan.
• No paid bug bounty.

If your organisation needs one of these, tell us before you buy, and we will say in writing what we can and cannot provide.

9. Reporting a security problem

Email contact@tradingagentapp.com with “Security” in the subject. Please include the steps to reproduce the problem, and do not access, change or delete data that is not yours. We reply by email. WU Capital Limited, 17 Beltany Drive, Flat Bush, Auckland 2019, New Zealand.