Does Marketdata.ai support SAML and SCIM for enterprise SSO?

Yes. On the Enterprise plan, Marketdata.ai supports enterprise single sign-on over SAML 2.0 and OpenID Connect, with SCIM 2.0 automated user provisioning and deprovisioning driven by your identity provider.

Is Marketdata.ai suitable for a bank or vendor security review?

Yes. Marketdata.ai provides federated SSO, automated user lifecycle over SCIM, least-privilege roles, audit logging, EU-hosted infrastructure, and a Data Processing Agreement. Security documentation, including an authentication and SSO security review, is available to customers and prospects under evaluation on request.

How does Marketdata.ai handle users who leave the organisation?

With SCIM 2.0, deactivating a user in your identity provider removes their membership from your Marketdata.ai account immediately, so re-authentication fails. Under the recommended policy their API tokens are revoked, any open session ends at the inactivity timeout, and the change is recorded in the audit trail.

Where is Marketdata.ai data hosted?

Marketdata.ai runs on EU-primary infrastructure with EU-first sub-processors and is operated under Dutch law. Customer data stays in the European Union.

Does Marketdata.ai offer a Data Processing Agreement?

Yes. A Data Processing Agreement is available, along with our sub-processor list and security documentation, on request.

Security at Marketdata.ai

How we protect your data, and how we help you pass an IT security review.

Built for finance, procurement, and market data teams at regulated firms.

Your IT security review comes before anyone signs in, so we document how sign-in, user lifecycle, hosting, and data protection actually work. The summary below is what buyers usually need to explain during vendor review. For the underlying documents, ask us and we will share them directly.

Hosting and data residency

Where your data lives, and who can touch it.

EU-primary infrastructure — your data stays in the European Union
EU-first sub-processors, with a current list available on request
Operated under Dutch law

Authentication and access control

How people sign in, and what happens the day they leave.

Enterprise SSO over SAML 2.0 or OpenID Connect, chosen per provider, with signed-assertion verification and domain-ownership proof
SCIM 2.0 automated user provisioning and deprovisioning from your identity provider
Two-factor authentication, least-privilege roles, and session inactivity timeouts
Deactivating a leaver removes their access immediately and is written to the audit trail

Encryption and data protection

How data is protected in transit and kept separate between customers.

Traffic encrypted in transit with TLS; HTTPS enforced with HSTS preload
Each customer account is logically isolated, with tenant scoping applied consistently
Passwords stored with bcrypt; API tokens held only as salted hashes

Application security

How we keep the code and the running service safe.

Peer code review and a secure development process
Every change scanned for known-vulnerable dependencies and run through static analysis, held to a clean baseline
Sign-in, password-reset, and API endpoints rate-limited against brute-force attempts

Privacy and GDPR

How we handle personal data and support your compliance obligations.

Built to align with the GDPR
Data Processing Agreement and sub-processor list available on request
Export or deletion of your data on request

Availability and disclosure

Uptime, and how to reach us about a security issue.

99.9% monthly uptime target
Report a suspected security issue to support@marketdata.ai
Security contact also published at /.well-known/security.txt

Request our security documentation

Customers and prospects under evaluation can request our Data Processing Agreement, sub-processor list, and authentication and SSO security review. Send your security questionnaire and we will work through it with you.

Talk to us about a security review Email support@marketdata.ai