Before you buy

Check it yourself.

Everything this company claims is published somewhere on this site, and you have no reason to believe any of it. So here are the checks you can run instead — each one a command or a URL, each saying what a pass actually establishes, which is usually narrower than the thing it supports.

7 of the 7 need no account and no API key. All were run on 2026-08-21.

1. Transport layer, re-run by a third party
No key needed
```
https://www.ssllabs.com/ssltest/analyze.html?d=api.twmarketdata.com
```
A pass establishes: A measured grade for the TLS configuration, issued by Qualys rather than by us. It says nothing about whether the data is right — only that the connection has no known protocol weakness.
2. The proof algorithm is published
No key needed
```
curl https://api.twmarketdata.com/v2/proof/recipe
```
A pass establishes: The hashing rules, the domain-separation prefixes, and that an odd node is promoted rather than duplicated (CVE-2012-2459). You do not have to ask us how it is computed; the rules answer for themselves.
3. Run the verifier on your own machine
No key needed
```
curl -O https://twmarketdata.com/twmd_verify_proof.py
python3 twmd_verify_proof.py --api https://api.twmarketdata.com \
  --dataset tdcc_shareholding_distribution --row-key "00400A|TWSE|2026-08-07|TDCC_01|tdcc_official|shareholding_distribution"
```
A pass establishes: That a given row really is in a signed snapshot. The script uses only the Python standard library and imports nothing of ours — a verifier that needed our code would be asking you to trust our code first.
4. History was not rewritten
No key needed
```
curl 'https://api.twmarketdata.com/v2/proof/consistency?first=40&second=157'
```
A pass establishes: That the log of published tree heads has not been removed from, reordered or rewritten. It does not prove each dataset's own tree is append-only — the endpoint's does_not_claim says so. And a single visit proves nothing: the comparison has to be against a root you recorded earlier.
5. A backtest cannot see the future
No key needed
```
curl 'https://api.twmarketdata.com/v2/datasets/monthly-revenue?symbol=2330&limit=3&as_of=2026-07-05'
```
A pass establishes: That disclosure data is filtered on knowledge date. The response's request_context reports point_in_time, as_of_applied and knowledge_time_field, so you do not have to believe we do it — you can read what it says. The filter runs before the row limit, which the response marks as as_of_filter_applied_before_limit.
6. Each dataset's gaps are written down
No key needed
```
https://twmarketdata.com/datasets/twse-daily-price/datasheet
```
A pass establishes: Composition, cadence, measured freshness, recorded gaps and licence, composed from the registry rather than written per dataset. A dataset flagged as carrying a backtest trap says so even while its disclosure text is still unwritten.
7. The answers that count against us
No key needed
```
https://twmarketdata.com/trust/self-assessment
```
A pass establishes: The full SIG-Lite / CAIQ-Lite self-assessment, including the open dependency CVE count, the penetration test we have not had, and the controls that are not implemented. A questionnaire whose every answer is favourable is one a reviewer stops reading.

What you cannot check from outside

A page of checks that all pass is a sales page in a lab coat unless it also says where the checking stops.

Whether the figures are right. Everything above establishes integrity and origin — if the official source published a wrong number, this attests faithfully to the wrong number.
Our internal operating practices. There is no SOC 2, no ISO 27001 and no third-party penetration test — the security facts sheet states that, including that all three are absent.
Enterprise file delivery. It exists, but a public probe cannot reach it, so it is not listed here as something you can check yourself. Ask us for an actual file manifest before designing around it.
How your agent or model behaves. What we supply is data-layer evidence; prompts, weights and output review sit with you.

1. Transport layer, re-run by a third party

2. The proof algorithm is published

3. Run the verifier on your own machine

4. History was not rewritten

5. A backtest cannot see the future

6. Each dataset's gaps are written down

7. The answers that count against us

What you cannot check from outside

Then what