Security

Bearer Token Authentication Active

• All authenticated endpoints require a Bearer token in the Authorization header.
• API keys are generated as cryptographically random 256-bit tokens.
• Keys are hashed (SHA-256) before storage — we cannot retrieve your original key. If lost, generate a new one.
• Each key is scoped to a single tenant and subscription tier.
• Keys can be revoked instantly via the API or dashboard.

Webhook Security Active

• Webhook deliveries include an HMAC-SHA256 signature in the X-Regime-Signature header.
• Each tenant receives a unique webhook signing secret at registration.
• Verify signatures server-side before processing webhook payloads to prevent spoofing.

Data in Transit Active

• All API traffic is encrypted via HTTPS/TLS 1.2+ (TLS 1.3 preferred).
• TLS termination is handled by Cloudflare with automatic certificate management.
• HTTP requests are automatically redirected to HTTPS.

Data at Rest Active

• Application databases use SQLite with WAL (Write-Ahead Logging) mode for data integrity.
• Sensitive configuration values (API keys, webhook secrets) are hashed before storage.
• Payment data is stored exclusively by Stripe and never touches our servers.

Multi-Layer Rate Limiting Active

• Per-key rate limiting: Enforced per API key based on subscription tier (10/120/1000 RPM).
• Per-IP rate limiting: Unauthenticated endpoints have IP-based limits to prevent abuse.
• Daily quota enforcement: Free and Pro tiers have daily call limits (200/10,000).
• Automatic throttling: Exceeding limits returns HTTP 429 with Retry-After header.
• Persistent abuse: Automated detection can temporarily suspend keys exhibiting abusive patterns.

No Sensitive Financial Data Active

Regime Intelligence is a read-only market intelligence API. We never ask for, receive, or store:

• Wallet private keys or seed phrases
• Exchange API keys or trading credentials
• Credit card numbers (handled exclusively by Stripe)
• Trading history or portfolio holdings
• Bank account information

Our API provides market data out. It never requires sensitive credentials in.

Cloudflare Protection Active

• DDoS mitigation: All traffic passes through Cloudflare's global network with automatic DDoS protection.
• Web Application Firewall (WAF): Filters malicious requests before they reach our servers.
• Rate limiting: Per-key request limits are enforced on every API request.
• Tunnel architecture: Web traffic reaches our origin server only through Cloudflare Tunnel. The server's firewall blocks direct connections to the application ports.

Application Security Active

• User-supplied values are passed to the database as bound parameters, not concatenated into SQL.
• CORS headers configured to prevent unauthorized cross-origin access.
• User-supplied text is HTML-escaped before it is shown in a page.

Data Minimization Active

• We store only what we need to run the Service: your email address, name, plan and billing status, hashed API keys, API usage logs, your email preferences and the record of them, and any feedback you send us.
• No payment data stored — all billing handled by Stripe (PCI-DSS Level 1).
• Detailed API usage logs are kept for 90 days, then reduced to a daily request count (see our Privacy Policy).
• No advertising cookies. We use PostHog product analytics, configured so it stores nothing in your browser (see our Privacy Policy), and Plausible, which is cookie-free.

Current

• HTTPS/TLS encryption on all endpoints
• GDPR-aligned data rights (access, deletion, export)
• Stripe PCI DSS compliance for payment processing
• Privacy-focused analytics (Plausible, no cookies)
• Cloudflare DDoS and WAF protection

Planned Roadmap

• SOC 2 Type II — Planned when reaching $50K+ MRR. Will cover security, availability, and confidentiality trust service criteria.
• Penetration testing — Annual third-party penetration testing planned at $25K+ MRR.
• Bug bounty program — Formal program planned at $100K+ MRR.