Skip to content
MarketPrior

Security & data handling

What we protect, and how.

The controls that exist in MarketPrior today — sign-in, workspace isolation, outbound fetching, keys, payments and personal data — described plainly, including what we do not claim.

See the controlsPrivacy policy

Platform controls

Your workspace stays your workspace

Tenant data is separated at the database level and every route re-checks who you are and which workspace you belong to.

auth

Sign-in on Supabase Auth

Accounts, sessions and email confirmation run on Supabase Auth. Every API call is checked against a verified token; there is no anonymous access to workspace data.

isolation

One workspace, one schema

Each workspace’s companies, reports and audit records live in their own Postgres schema, and every tenant route is bound to the caller’s workspace — there is no workspace parameter to tamper with.

rls

Row-level security as a second wall

Row-level security is enabled on shared tables and client roles are locked out of billing and configuration tables. The backend itself uses a privileged role, so the workspace guard — not RLS alone — is the primary control.

ssrf

SSRF-safe outbound fetching

Every fetch of a company website goes through one guarded client: public addresses only, the resolved IP pinned for the connection, each redirect re-validated, and response size and time capped.

share links

Share links that expire

A memo share link is signed, bound to one workspace and one company, expires (30 days by default) and can be revoked individually without affecting any other link.

audit

Hash-chained analysis ledger

Each analysis snapshot is chained to the previous one with a SHA-256 hash, so a changed record breaks the chain and shows up on verification.

API keys

Hashed, scoped and revocable

API keys for the REST API and MCP server are shown to you once. We store only a SHA-256 hash and a short display prefix.

  • Each key is bound to one workspace — every call runs as that workspace.
  • Keys carry scopes; only allowed scopes can be granted, and an empty selection defaults to read-only.
  • Revoke a key at any time from the dashboard; it stops working immediately.
  • Retries sent with an Idempotency-Key replay the first response and are never charged twice.

Details in the diligence REST API reference.

Payments & entitlements

Stripe takes the card, the server enforces the plan

Checkout is hosted by Stripe. What you are allowed to run is decided server-side from your workspace’s entitlement record — the same rules apply in the app, the API and MCP.

  • Your plan is set from the price Stripe reports you bought, never from session metadata.
  • Paid actions reserve their unit before they run and are refunded automatically on failure.
  • Locked report sections are refused by the server, not just hidden in the browser.

See pricing and what is metered.

GDPR & contact data

Business contacts, from public pages, with a lawful basis

The lead feed stores business contact data only. These rules are enforced before anything is saved:

  • Only addresses at the company’s own domain — free-mail and personal addresses are never collected, for anyone.
  • Only public pages: no logged-in areas, no login-walled sources.
  • Every stored field records its source URL and when it was collected.
  • A lawful basis is recorded per person: statutory public register, or legitimate interest for B2B prospecting.
  • EU, EEA, UK and Swiss subjects are flagged and get stricter rules — no pattern-guessed email unless the pattern is evidenced on the company’s own public pages.
  • Contacts not re-seen within the retention window are deleted.
opt-out & DSR — public, rate limited
# Opt out: global suppression + erasure of that address
POST /v1/contacts/opt-out
{ "email": "you@company.com" }

# Data-subject request: export | delete | opt_out
POST /v1/contacts/dsr
{ "email": "you@company.com", "action": "export" }

# Export is released only after you confirm from that mailbox
POST /v1/contacts/dsr/confirm

Also by email: privacy@marketprior.com. Read the privacy policy and data processing agreement.

Data & models

Public records in, open-weight models by default

Public records only

Findings come from public registers, filings, court and regulator records, sanctions lists and public signals, used under each source’s published licence. Every source and its licence is listed on the data sources page.

Our own model gateway

Extraction and memo-writing calls go through our own model gateway (EU region by default), which uses open-weight models unless we explicitly configure another. Scores and verdicts are computed deterministically — see how a verdict is built.

Security review · 27 Sept 2026

What our last review found, and what we fixed

An internal white-box review of authentication, tenant isolation, the public API and MCP, billing, contact data, outbound fetching and share links. Five findings; all five fixed in code.

  • High — server-side request forgery via a company website crawl. Fixed with the guarded outbound client described above.
  • Medium — share links could not be revoked and did not expire. Now expiring and individually revocable.
  • Medium — internal tool endpoint failed open without its secret. It now refuses to start instead.
  • Low — disabling an operator account did not revoke its existing tokens. Revocation is now enforced.
  • Low — report unlocks were matched by company name. They are now matched by id.

What we don’t claim

  • No SOC 2, ISO 27001, HIPAA or other security certification is held.
  • No third-party penetration test yet; the review above was internal.
  • The review spot-checked row-level security rather than auditing every table.
  • MarketPrior is decision support — not investment advice and not a consumer report.

Found something? Email security@marketprior.com.

FAQ

Security questions

Is MarketPrior SOC 2 or ISO 27001 certified?
No. We do not hold SOC 2, ISO 27001 or any other security certification, and we will not imply otherwise. This page describes the controls that exist in the product today.
Where do payments go?
Payments are taken by Stripe Checkout. Card details go to Stripe, never to our servers. Your plan is set from the price Stripe reports you bought, not from anything the browser sends.
Do you use AI models on my data?
Language models extract facts and write the memo prose. Those calls go through our own model gateway, which uses open-weight models by default; a hosted third-party model is only used if we explicitly configure one. Models never decide the verdict.
How do I get a contact record about me removed?
Send an opt-out or a data-subject request to the endpoints above, or write to privacy@marketprior.com. Opt-out suppresses the address globally and erases it; responses are uniform so nobody can use them to test whether an address is on file.
How do I report a vulnerability?
Email security@marketprior.com with the details and steps to reproduce. Please don't access other customers' data or degrade the service while testing.

Diligence you can audit.

Every finding cited to a public record, every workspace kept separate.

Start freeSee the data sources