We hold no customer data.

At a glance

Our operating model

MarketPsych is a data producer, not a data custodian. We continuously analyze publicly available text media - news, press releases, filings, and social media - using proprietary software, and sell the resulting structured datasets and analytics. Client relationships involve delivering our data outward; no client datasets, portfolios, documents, or personal information flow into our environment.

This shapes our risk profile. The assets we protect are our own intellectual property - software and derived datasets - and the integrity and availability of the data feeds our clients rely on. There is no client data to segregate, retain, delete, or breach.

Publicly available media can incidentally contain personal data (for example, individuals named in news articles). We process such data as part of the public record under legitimate interests, and we hold no personal data belonging to our customers or their clients.

Infrastructure and availability

Our processing runs on hardware we own, hosted in two independent colocation facilities, complemented by AWS and Google Cloud. Our primary facility, Flexential, maintains its own SOC 2 attestation covering physical and environmental security, which we can share on request under NDA.

• Mirrored infrastructure across datacenters; a facility-level failure does not take our services offline.
• Daily backups, with copies in AWS and Google Cloud storage and additional offline off-site cold backups.
• Continuous hardware and software monitoring across the fleet, in place since the infrastructure was commissioned.
• All servers run currently supported Debian releases, with security updates applied on an ongoing basis.
• Public web services and APIs are fronted by Cloudflare. API endpoints serving long-running requests are, by design, served directly over TLS with authenticated access, as proxying is incompatible with their response times. All client delivery channels use TLS.

Access control and identity

• Google Workspace is our primary identity provider, with multi-factor authentication enforced.
• Server access is key-based over SSH, with accounts managed through a central directory (LDAP); internal services are reached over a WireGuard VPN.
• Access is revocable centrally: disabling a directory account removes access to servers, repositories, and internal services together.
• We operate a documented offboarding process covering identity, communication tools, VPN, and server access.

Product security: on-premises Text Tagging Engine

Our Text Tagging Engine is also available as containers deployed inside customer infrastructure. Because this software runs in your environment, we apply supply-chain and release controls to every customer-shipped image:

• Software bill of materials. Every release ships with an SBOM in CycloneDX 1.5 and SPDX 2.3 formats, covering all OS and Python packages and included models with pinned versions, SHA-256 hashes, and licenses.
• Vulnerability scanning. Every image is scanned before release, and all published image tags are re-scanned weekly against the current vulnerability feed. Findings are triaged against a written deployment threat model, with each disposition documented and reproducible.
• Remediation commitment. Where a re-scan surfaces a new HIGH or CRITICAL finding with an upstream fix available, we publish a patched image within 10 business days of detection.
• Image signing. Releases can be signed with cosign (Sigstore); customers receive the public key at delivery and can verify any tag before deploying.
• Minimal attack surface. No shell, no SSH daemon, and egress limited to two HTTPS hostnames (our license server and container registry).

Detailed, versioned documentation - SBOMs, triaged scan reports, and the deployment threat model - is available to customers and evaluating prospects under NDA.

Data integrity

Our clients feed our data into research, models, and investment processes, so the accuracy and consistency of our output is the core of what they buy. Changes to processing code go through version control with review on our self-hosted repositories, pipelines are monitored end to end, and output is checked for completeness and consistency before and after delivery. Delivery channels are authenticated and served over TLS.

Compliance

We maintain internal security policies and are formalizing our security program; SOC 2 attestation is under evaluation. If and when a report is issued, it will be shared with clients and prospects under NDA.

In the meantime, we support client due diligence directly: we complete security questionnaires (including CAIQ/SIG formats), join calls with risk and security teams, and provide the documentation listed below. Physical and environmental security of our primary facility is covered by Flexential's own SOC 2 report.

Request documentation

The following are available under NDA:

• Completed security questionnaires, or responses in your own format
• Flexential SOC 2 report (physical and environmental controls for our primary facility)
• Text Tagging Engine SBOMs and triaged vulnerability scan reports
• Internal security policies and our security practices summary

To request documentation or raise a security question, contact [email protected]. To report a suspected vulnerability in our products or services, use the same address; we acknowledge reports within two business days.

This page describes our practices as of the date above and is updated as our program evolves.