Security

In transit

Every page and every API call is served over HTTPS with modern TLS. Plain HTTP is redirected, so a key is never sent over an unencrypted connection.

API keys

• Keys are generated from a cryptographically secure random source.
• The secret is shown once, at creation, and is never retrievable afterwards.
• Only a SHA-256 digest is stored, so a copy of the database cannot be replayed against the API.
• Key comparison is constant-time, so the check gives no timing signal.
• Revocation takes effect on the next request — there is nothing to flush or expire.

Request metering

Rate limits need to know how often a client is calling, not who they are. Public requests are grouped with a one-way hash of the calling address; the address itself is never written to the counters. Account usage is stored as a running total, not as a log of individual calls.

Access control

Database rules are applied per record and per user: an account's keys, quota and purchases are readable only by that account, and only administrative operations can write metering records. Server-side code that must see more than the caller runs in a restricted path that is never exposed to the browser.

Payments

Payments run through PayPal's hosted checkout. Card data never touches Fiat Agent's servers, and an order is only credited after the capture is confirmed with PayPal server-side.

Data integrity

Readings are fetched from the upstream provider, stored as timestamped snapshots, and served from that store. Every response carries the time of the reading it came from, so a client can always tell how current a figure is.

If something goes wrong

If we confirm a security incident that affects account data or keys, affected account holders are told without undue delay, along with what was exposed and what to do. Keys involved in an incident are revoked.

Reporting a vulnerability

If you think you have found a vulnerability, write to us from the email address on your account before disclosing it publicly. Include what you did, what you observed and how it could be reproduced. We acknowledge reports within 3 business days, keep you informed while we investigate, and will not pursue action against research that stays within the terms of service and avoids privacy violations, data destruction or service disruption.

What we do not claim

No service is unbreakable. These measures reduce risk; they do not make a guarantee of absolute security, and the terms of service limit liability accordingly.