The data
Every figure the API serves comes from public SEC filings: the SEC's Financial Statement Data Sets and its XBRL frames API. The dataset holds no customer data, and nothing you send us is mixed into it.
Your account
- API keys are stored as a SHA-256 hash. The full key is shown once, when it is issued. After that we hold the hash and the first eight characters, enough to tell you which key an account is on and not enough to use it. Regenerating a key stops the old one immediately.
- No password is required. Sign-in is by a link sent to your email. If you set a password, it is hashed with bcrypt and we cannot read it back.
- Sessions are one signed cookie: HttpOnly, Secure, SameSite=Lax.
- Deletion is self-serve. Deleting an account from the dashboard removes it with its key, usage logs, watchlist and webhooks, and cancels any subscription.
Payments
Paying takes you to Stripe's own checkout page. Card details are given to Stripe and never pass through this service or reach its database.
Webhooks
Alerts sent to your own URL are signed: each request carries a
BalanceProof-Signature header with a timestamp and an
HMAC-SHA256 of the timestamp and the body, under a secret only you and
we hold. Check it before you trust the payload; the
API reference shows how.
Where it runs, and who else sees what
- Railway hosts the application and its database. Every page and API call is served over HTTPS.
- Stripe handles payments, only if you buy something.
- Email delivery (Resend or AgentMail) receives your address when we send a sign-in link or an account email.
- OpenRouter receives a question only if you use the optional question box on a company page.
No third-party analytics, no advertising identifiers, no cross-site tracking. IP addresses are not stored; rate limiting uses a salted digest that cannot be turned back into an address. The full list is in the Privacy Policy.
Certifications
We do not hold SOC 2 or ISO 27001 certification. If your review needs something this page does not answer, ask us and we will tell you what we can.
Reporting a problem
If you find a security issue, email support@balanceproof.dev before sharing it anywhere else. We read every report.
No system is perfectly secure, and we do not claim otherwise.