FinaQuotes
ENRU

Security

Security of the FinaQuotes data feed

Access to the FinaQuotes data feed is protected by personal API keys and HMAC authentication on the WebSocket connection, served over TLS only. Each client gets its own key and secret, keys can be rotated or revoked at any time, and secrets are stored encrypted on our side. We keep only the client data we need to run the service.

Authentication

A WebSocket connection to the feed is authenticated with HMAC. The client signs its login message with the secret using HMAC-SHA256; the secret itself is not sent. The exact signing scheme is described in the documentation.

Keys and secrets

  • Personal keys. Every client gets its own key and secret. Keys are not shared between clients, so access can be traced and withdrawn one client at a time.
  • Shown once. The secret is displayed a single time, when it is issued. We cannot show it again later; if it is lost, a new one is issued.
  • Keep it on your server. The secret belongs in your server environment or secret store, not in source code, browser scripts or mobile apps. Sign on the server and pass data to the front end from there.
  • Encrypted at rest. On our side secrets are stored in encrypted form, never in plain text.
  • Rotation on request. A client can ask for a new key and secret at any time, for example when a team member leaves. The old pair stops working once the new one is issued.
  • Revocation on leak. If a secret may have leaked, tell us and we revoke the key immediately. Active connections made with it are closed.

Transport and isolation

  • TLS only. The feed and the API are available over wss and https. Unencrypted connections are not accepted.
  • Separate channels. Free widgets, Pro widgets and the data feed run on separate channels with separate access rules. A public widget gives no path into the feed.
  • Rate limits. The REST API applies limits per IP address to protect the service from abuse. Normal integrations stay well within them.

Data we keep about clients

We collect the minimum needed to run the service: contact details from your request, the keys issued to you and the technical logs of your connections. We do not need, and do not ask for, data about your end users. More on this in the privacy policy.

What we do not publish

We do not disclose our data vendors, hosting or internal architecture. This page describes what matters for your integration; the rest stays private by design.

Reporting a vulnerability

If you believe you have found a security issue in the feed, the API, the widgets or this website, please tell us through the contact form and choose "Other" as the topic. Our security.txt lists the same contact.

We follow responsible disclosure. Give us reasonable time to investigate and fix the issue before making it public, and do not access other clients' data or disrupt the service while testing. We will confirm receipt and keep you informed while we work on it.

Put the whole market on one connection

Tell us about your platform and the markets you need. We reply within one business day with access details.