Data & security

Every record belongs to an organisation, and access rules are enforced in the database rather than only in the interface. A signed-in user can read and write records for their own organisation only.

Store access tokens and API keys are write-only from the interface: they are used to publish on your instruction and are never displayed back in full. Provider secrets — for ingestion signing, ad research and visual sourcing — are held server-side and are never shipped to the browser.

Public ingestion endpoints require a signature computed with a shared signing secret and are rate-limited. Requests that fail verification are rejected and recorded. This design exists so an external collection pipeline can write into your workspace without exposing a writable open endpoint.

Some features send data to external services when you use them: commerce platform APIs when publishing, a currency rate source, and any optional provider you enable with your own key. Each provider has its own terms and privacy practices, and requests carry only what the feature needs.

Records carry their source and the time they were fetched. Verification states for suppliers are explicit, and the highest tier depends on human or partner review. Charts plot the observations that exist; gaps are shown as gaps.

Ingest runs, publishing attempts and errors are logged so failures can be diagnosed. Workspace data is retained while the account is active; deletion can be requested through support.

NicheTrendFinder holds no security certification and has not completed an independent audit. We do not describe the service as SOC 2, ISO 27001, GDPR, CCPA, HIPAA or PCI compliant. If your organisation needs a formal assessment or a data-processing agreement, contact us and we will tell you honestly what is and is not in place.

Report suspected vulnerabilities to security@nichetrendfinder.com — configure this address before launch if it is not yet in use — with enough detail to reproduce the issue. Please do not test against another organisation's workspace.