What buyers can verify about security.
Buyer-readable security summary: infrastructure location, access control, compliance posture, and responsible disclosure in one place.
Use this page to verify what is in place, what is partial, and what has not been externally audited yet before treating any security claim as settled.
Last updated: October 2026
Published by MarketDepth Analytics OÜ (registry code 17549629, Estonia), the legal entity behind DepthSignal.
What This Covers
Infrastructure location, access controls, encryption posture, subprocessors, and disclosure workflow.
Controls and Assurance Status
Documented controls, their current status, and assurance items that have not been externally audited.
What This Is Not
This page is a public summary, not a claim that every framework is certified or every artifact is disclosed publicly.
Our security posture
DepthSignal serves quantitative analysts, trading desks, and data science teams that need reliable orderbook data. We maintain documented internal security controls, with policies, a risk register, and regular management reviews. No external security-framework audit or certificate has been completed. This page gives buyers key security details in one place. If you need more, contact security@depthsignal.io.
Data residency
All production infrastructure runs on Hetzner datacentres in Germany and Finland (European Union). Customer data stays in the EEA unless it is sent to subprocessors outside the EEA under GDPR Chapter V safeguards where applicable. The core current public workflow set is listed below. Additional optional or configuration-dependent providers are disclosed in the DPA and current subprocessor records.
- RoxPay is the primary payment-service-provider adapter for supported DepthSignal checkout flows. RoxPay handles hosted payment details; DepthSignal's billing and tax authority remains the central system of record for payment references, invoice records, refunds, subscription state, settlement tracking, and VAT/GST monitoring. Provider configuration, checkout availability, payment-event processing, and notification delivery remain subject to the current account and environment state.
- Resend: transactional email (GDPR Chapter V safeguards; see current DPA Section 9)
- Linear, Inc.: automatic bug report ticket creation and follow-up (GDPR Chapter V safeguards; see current DPA Section 9)
- OpenAI OpCo LLC: AI chat feature, when enabled by the customer (GDPR Chapter V safeguards; see current DPA Section 9)
- Cloudflare: CDN and DDoS mitigation (GDPR Chapter V safeguards; EU nodes for EU traffic)
Optional application Umami analytics checks analytics consent before the tracker loads. The endpoint can be configured per deployment; whether separate CDN or edge request processing is active is not confirmed on this page.
Hetzner states its datacentre operations are covered by ISO 27001 audited controls. Physical security includes 24/7 staff, CCTV, controlled access, and redundant power and cooling.
The customer-facing API runs in a dedicated network zone, separate from internal data and processing services. Network segmentation and least-privilege service access help reduce blast radius if a component is compromised.
Controls highlights
Access control
| Customer passwords | We hash passwords with Argon2id; legacy PBKDF2-HMAC-SHA256 (600,000 iterations, NIST SP 800-132) hashes verify transparently and rehash on login. We also check new and reset passwords against known breach data using a k-anonymity API. |
| Two-factor authentication | TOTP (optional for customers; mandatory for all internal company access). |
| Brute-force protection | Automated controls detect brute-force attempts and apply temporary protection when risk is high. |
| API keys | API keys are hashed at rest. The plain key is shown once when created and cannot be recovered later. |
| Internal access | Internal controls are limited to authorized staff with least-privilege access. Sensitive actions require MFA and extra verification. |
| Internal operations log | Security-related internal actions are written to append-only audit records with integrity checks. Retention follows legal and compliance rules. |
Encryption and transport
| Data in transit | External traffic uses TLS (1.2+). HSTS is enabled on supported production endpoints. |
| Certificate management | Automated provisioning and renewal via Let's Encrypt. |
| DDoS / TLS termination | Cloudflare in front of public application endpoints. |
| Customer passwords | Passwords are hashed with Argon2id; legacy PBKDF2-HMAC-SHA256 (600,000 iterations, NIST SP 800-132) hashes verify transparently and rehash on login. |
| API keys | One-way cryptographic hash. Plaintext is not retained after issuance. |
Application security
| Input validation | Core APIs use schema validation with typed models. |
| SQL injection | Production services use parameterized queries and ORM safeguards. |
| Error handling | Generic messages to clients. Stack traces logged server-side only. |
| Automated attack detection | Security middleware and monitoring detect malicious request patterns and apply automated protection. |
| Mandatory code review | Changes to production systems require peer review before deployment. |
| Automated tests | We run automated tests, including end-to-end tests for critical paths. |
Monitoring and incident response
| Service watchdog | The April 23, 2026 incident response plan lists Watchdog alerts for service degradation and health-check failures and names the Managing Director as the sole internal escalation point. This describes the documented plan; it does not establish current alert delivery or staffed coverage. |
| Breach detection | We run anomaly detection and alerting across authentication, data access, and platform behavior. |
| Security event log | Security events are stored in append-only audit records with integrity controls. Retention follows legal and compliance rules. |
| Incident notification | Personal data breach notification to Estonian DPA (AKI) within 72 hours of becoming aware, per GDPR Article 33. |
Backup and business continuity
| Backup cadence | Automated backups run on a schedule across core data stores and critical app state. |
| Retention | Backup retention follows a documented schedule based on recovery and legal needs. |
| Redundancy | Hetzner-managed infrastructure with automated snapshots independent of the application layer. |
| Recovery testing | The April 2026 continuity plan records PostgreSQL and Redis restore checks to a development environment, last tested in Q1 2026. A full disaster-recovery simulation was scheduled for Q3 2026; completion is not recorded on this page (verified 2026-10-21). |
GDPR and data rights
DepthSignal is a data controller under GDPR. MarketDepth Analytics OÜ processes personal data based on contract necessity (Article 6(1)(b)) and, where needed, consent (Article 6(1)(a)). The supervisory authority is the Estonian Data Protection Inspectorate (AKI).
Customers can exercise their rights at any time via the platform:
| Right | How to exercise |
|---|---|
| Access (Art. 15) | GET /v1/customer/export returns selected customer-account data; it excludes separate controller-side newsletter records, which may not be linked to an account. Other data requires a separate access request. |
| Rectification (Art. 16) | PATCH /v1/customer/me |
| Erasure (Art. 17) | DELETE /v1/customer/me - removes live account/API/usage data; billing records and Article 16(m) consent evidence can remain on their own legal-retention basis |
| Portability (Art. 20) | GET /v1/customer/export provides machine-readable customer-account data; separately stored newsletter records are not included. |
| Opt-out of analytics (Art. 21) | POST /v1/customer/me/analytics/opt-out |
Current self-service GDPR-rights endpoints are available for export, rectification, erasure, and analytics opt-out through GET /v1/customer/export, PATCH /v1/customer/me, DELETE /v1/customer/me, and POST /v1/customer/me/analytics/opt-out.
Subprocessors
The subprocessors below cover the current public workflow set. Transfer rules apply where data leaves the EEA. Optional or configuration-dependent providers remain documented in the DPA and current subprocessor records.
| Subprocessor | Purpose | Transfer mechanism |
|---|---|---|
| Hetzner Online GmbH | Cloud infrastructure, compute, storage | EU/EEA (Germany, Finland). No international transfer. |
| RoxPay payment-service-provider adapter | Hosted payment processing for supported DepthSignal checkout flows. DepthSignal's billing and tax authority remains the system of record for customer, invoice, refund, subscription, settlement, and tax records. Availability and event handling depend on the current account and environment state. | RoxPay is the primary payment-service-provider adapter for supported DepthSignal checkout flows. It processes hosted payment details; DepthSignal remains the billing, invoice, tax, subscription, settlement, and entitlement authority. The provider's current processing terms and applicable safeguards govern the provider-side transfer details. |
| Resend Inc. | Transactional email delivery | GDPR Chapter V safeguards (see current DPA Section 9) |
| Linear, Inc. | Automatic bug report ticket creation and issue follow-up for voluntarily submitted reports | GDPR Chapter V safeguards (see current DPA Section 9) |
| OpenAI OpCo LLC | AI chat feature (when enabled by customer) | GDPR Chapter V safeguards (see current DPA Section 9) |
| Cloudflare Inc. | CDN, DDoS mitigation, TLS termination | GDPR Chapter V safeguards (see current DPA Section 9); EU customers served from EU edge nodes |
Application analytics uses the configured Umami endpoint only after the application consent check. This does not describe separately configured CDN or edge request processing.
We give at least 30 days notice for material subprocessor changes. Requests for additional subprocessor documentation can be sent to legal@depthsignal.io.
Compliance resources
You may contact security@depthsignal.io. to request additional security and compliance materials.
For security reasons, the public page is a summary. Detailed evidence is shared under NDA during qualified due diligence.
Assurance artifacts
Teams running formal security review can request a current assurance pack with control summaries, evidence mapping, and process documents for vendor security reviews.
- Internal control mapping and security-policy documentation
- Business continuity and incident response process summaries
- Subprocessor and transfer mechanism documentation.
- Data protection controls, retention rules, and deletion workflow evidence
Responsible disclosure
If you discover a security vulnerability in the DepthSignal platform, report it to security@depthsignal.io.
Response commitments
- We acknowledge good-faith security reports through the active disclosure workflow after receipt and validation.
- Severity triage and response routing follow the active disclosure workflow after the report is confirmed as in scope.
- Coordinated disclosure timing follows the active disclosure workflow after a valid issue is confirmed.
- We intend to treat good-faith security research that stays within this policy as responsible disclosure rather than abusive use, while reserving the right to take proportionate action to protect users, systems, and legal obligations.
PGP encryption
If you would prefer to submit an encrypted report, email security@depthsignal.io to request the current encrypted-report instructions.
Scope
In scope: depthsignal.io, api.depthsignal.io, sentinel.depthsignal.io, and other targets confirmed by our security team. Out of scope: infrastructure not run by MarketDepth Analytics OÜ and third-party subprocessors (Cloudflare, payment providers, etc.).
Full acceptable-use policy: /legal/acceptable-use §4.
Contact
Security review and procurement
For security questionnaires, vendor assessments, or procurement due diligence, contact security@depthsignal.io. DPA requests and legal correspondence should be sent to legal@depthsignal.io.
Security issues
security@depthsignal.io (vulnerability reports and security questions only).
Legal and data protection
legal@depthsignal.io (DPA requests, GDPR rights, legal correspondence).
MarketDepth Analytics OÜ
Registry code: 17549629 · Estonia
This document is reviewed at least annually. For the most current version, contact legal@depthsignal.io.