KnowFirm is a B2B data API — security and data integrity are foundational, not afterthoughts. This page describes how we protect your account, your API keys, and the data we serve.
All API traffic is served over HTTPS with TLS 1.2+. Plaintext HTTP requests are rejected. Webhook deliveries use HTTPS-only endpoints with HMAC-SHA256 signature verification.
Data is stored in managed Postgres (Supabase) with AES-256 encryption at rest. Backups are encrypted. API key secrets are stored as irreversible hashes — the full key is shown once at creation and never stored or logged.
API access requires a scoped API key with optional IP allowlists and per-operation scope restrictions. Dashboard access uses OAuth 2.0 (Google) with optional TOTP MFA. Admin operations require step-up authentication (AAL2) when MFA is enrolled.
Per-key rate limiting (120 requests/minute) and per-IP edge throttling protect against abuse. Hard credit quotas prevent runaway billing — requests over your allowance are blocked, never billed as overage.
KnowFirm resolves business data from authoritative public records (IRS, GLEIF, SEC EDGAR, FDIC, DOL, CMS, CFPB, CSL). No consumer data is collected or processed. The product is not a consumer reporting agency under FCRA and is not used for credit, employment, insurance, or housing eligibility decisions.
Business representatives can request data review or suppression via the opt-out form. Suppression requests are processed promptly and survive data refreshes. See the Opt-Out Policy for details.
Security issues can be reported to security@knowfirm.com. The RFC 9116 security.txt is published at /.well-known/security.txt with a valid disclosure policy.
Dependabot monitors all dependencies for known vulnerabilities. Critical and high-severity alerts are patched promptly. The CI pipeline runs security checks on every pull request.