Trust & security
Security architecture and governance
What is in place today, what is in progress, and what has not started — stated plainly, not certified.
On this page
Identity & access
| Item | Status | Note |
|---|---|---|
| Session revocation | In place | Server-side sessions with explicit revocation — signing out (or an admin action) invalidates a session immediately, not just on token expiry. |
| Entitlement chokepoint | In place | Every data-plane request passes through one check: access is verified server-side against what an organization is actually entitled to, never inferred from the client. |
| Route-scoped security headers | In place | Content-Security-Policy and Cross-Origin-Opener-Policy tailored to what each surface actually needs, not one loose policy site-wide. |
| Multi-factor authentication and SSO | In progress | TOTP enrollment exists for institutional accounts today. Single sign-on does not, so this row stays in progress. |
| Database-level tenant isolation | In progress | Tenant isolation is enforced in application code today, and tested against cross-organization access. Per-organization row-level security predicates at the database layer do not exist yet, so this row stays in progress. |
Application security
Practices that run on every change to this codebase, not a point-in-time claim.
| Item | Status | Note |
|---|---|---|
| Secret scanning | In place | Automated secret scanning runs over the codebase. |
| CI merge gates | In progress | CI is configured for lint, type checks, unit tests, a production build, secret scanning and accessibility checks. Configuration alone does not show that a run passed. Branch protection is not enforced. |
| Encryption in transit | In place | TLS for all traffic to the site and its APIs. |
| Server-side data-plane calls | In place | The browser is never handed direct venue or database access. |
| Encryption at rest | In place | Provided by default at the infrastructure layer (Supabase-managed Postgres). |
Compliance & operational readiness
Said plainly rather than left unmentioned, including where a program has not started at all. This section exists so a diligence review does not have to guess at what is absent.
| Item | Status | Note |
|---|---|---|
| Audit logging | In place | Two trails: an organization activity log (account connections, imports, mapping reviews, exports, member and entitlement changes) and a security log of authentication and authorization events. The security log is append-only at the database layer — the application role holds insert and select, never update or delete. |
| Incident response | In progress | A written runbook covers severity levels, containment, evidence preservation, credential rotation and postmortems. It has not been rehearsed against a real or simulated incident, and no customer breach-notification threshold is committed yet. |
| Penetration test | Not started | An independent third-party penetration test. |
| Business continuity | Not started | A business-continuity and disaster-recovery plan. |
| Third-party certification | Not started | SOC 2, ISO 27001, or any other third-party security certification. |
Data governance
The rules that govern everything the platform publishes — and, just as plainly, what is deliberately not committed yet.
| Item | Status | Note |
|---|---|---|
| Provenance on every figure | In place | Canonical Monitor figures carry their source, an as-of time, and applicable methodology identifiers. Eligible licensed US records can enter shared workflows; the dedicated Polymarket US workspace displays source and observation times for venue-provided data. |
| Entitlement-aware delivery | In place | What an organization can see is governed by what it is actually entitled to, checked on the server for every request. |
| Published retention schedule | In progress | Two categories are purged automatically — raw quote ticks after 90 days, order-book snapshots after 30 — and both are market data. Your organization’s own records have no automatic expiry; we delete them on request within 30 days. Published in full under Retention in our privacy policy. What is still missing is automated deletion and a contractually committed schedule, which is why this is in progress rather than in place. |
| Availability SLA | Not started | No uptime or availability SLA is offered yet; it follows the identity work above. |
Subprocessors
Infrastructure providers with access to a defined slice of the data or of the request path. The same list appears in Section 4 of the Privacy Policy.
Institutional platform
| Provider | Purpose | Data |
|---|---|---|
| Vercel | Application hosting, edge network, and cookieless page-view analytics. | HTTP requests to the site and aggregate page views. |
| Sentry | Error monitoring and diagnostics. | Error reports, scrubbed of cookies, auth headers and wallet/amount fields before ingest. |
| Supabase | Managed Postgres database. | Everything the site stores, institutional access requests included. |
| Resend | Delivery of account email: the sign-in verification code every time you authenticate, and, separately, opt-in product notifications. | Your email address, the message body, and, for a notification, only where you provided an address for it. |
Legacy wallet & Partner Sandbox products
Involved only where you used the legacy wallet product or the Partner Sandbox — not in Predict Here Institutional / Monitor.
| Provider | Purpose | Data |
|---|---|---|
| Order-routing provider (retired) | Relayed Partner Sandbox orders to the source venues before that lane was permanently retired. | Order details for orders a user signed. |
| RPC providers | Blockchain reads for the legacy wallet product. | Wallet addresses queried on a user's behalf. |
Security contact
Found an issue, or have a question about our security posture? Email us directly; the full disclosure policy and scope sit on their own page.
We aim to acknowledge security reports within one business day.
We do not publish a PGP key today. If encryption matters for your report, say so when you write in and we'll agree on a secure channel.
Send us your questionnaire
Request institutional access and include your questionnaire — we'll respond directly.