TW Market Data LogoTW Market Data

Security you can verify — not just trust.

TWMD is a Taiwan market data platform built for quantitative research and AI agents. Our security posture turns on one idea: you do not have to trust us — you can check.

Security review packContact us
twmd_verify_proof.py — verified against production
{
  "dataset": "twse_daily_price",
  "snapshot_version": "2026-08-14",
  "root": "1b5b0b1995eb389f3ea7807f51d22ffcee8c4dedbc1c87d5d11d36ad033b95b9",
  "leaf_count": 1378,
  "path_length": 11,
  "merkle_path_reaches_root": true,
  "verified": true,
  "proves": "integrity and origin, NOT semantic correctness"
}

$ curl -O https://twmarketdata.com/twmd_verify_proof.py python3 twmd_verify_proof.py --api https://api.twmarketdata.com --dataset tdcc_shareholding_distribution --row-key "00400A|TWSE|2026-08-07|TDCC_01|tdcc_official|shareholding_distribution"

Verifiable data integrity

Prove a historical value is the one we published, without trusting us. Signed checkpoints, a published algorithm, and a script you run yourself.

Infrastructure security

TLS 1.2/1.3 only with an A+ grade anyone can re-run, Cloudflare at the edge, and daily encrypted off-site backups.

Sources and access

First-hand official disclosure, no material non-public information and no personal data, and API keys scoped by plan.

Built on

CloudflareContaboPolarResend

Verifiable data

Prove every historical value.

Every delivery can be checked for tampering independently of us. Built for backtest integrity, where a silently altered history is worse than no history.

/v2/proof/checkpointsevery signed root, with a real row_key example/v2/proof/recipehash construction, path rules, version policy/v2/proof/inclusionthe path for one row — a path, not a verdict/v2/proof/public-keythe Ed25519 key the roots are signed with

Signed Merkle checkpoints

Each published snapshot commits to a root signed with our Ed25519 key. Four public endpoints carry the checkpoints, the algorithm, the inclusion path and the key.

A verifier you run, not one we run

twmd_verify_proof.py is standard library only — no dependency on our package and nothing from PyPI. A verifier that needed our code would be asking you to trust our code.

Point-in-time by knowledge date

Disclosure rows carry a knowledge date, set conservatively to the statutory filing deadline — late rather than early, so a query cut on it cannot see a figure before the market could. Passing as_of applies that cutoff server-side and the response reports as_of_applied and the field it cut on, so you can confirm it took effect.

How verification works →Provenance and C2PA →Download twmd_verify_proof.py →

It proves integrity and origin. It does not prove a figure is correct: if the official source published a wrong number, this attests faithfully to the wrong number.

Infrastructure

Hardened by design.

The parts a reviewer can re-measure themselves, measured and dated — including the one that is not yet where we want it.

Qualys SSL Labs

measured 2026-08-17

A+

Grade A+ on all four endpoints. TLS 1.2 and 1.3 only — 1.0 and 1.1 are refused. No RC4, forward secrecy with every tested client, and no POODLE, Heartbleed, FREAK or Logjam exposure.

Re-run the scan yourself

Transport

Qualys SSL Labs A+ on all four endpoints, HSTS enabled, TLS 1.2 and 1.3 only. Publicly re-checkable — the link below runs the same scan we did.

Edge

Cloudflare provides WAF and DDoS protection in front of the site and the API. It is our infrastructure supplier, not a security product we sell.

Backups

Daily encrypted off-site backups to Cloudflare R2. Application-layer protections — parameter-bound queries, SSRF blocking of private and metadata ranges, namespace authorisation isolation — are stated as design principles, not as tested-and-complete.

Sources and access

Official sources. Scoped access.

Where the data comes from, what is deliberately not in it, and who can reach it.

Sources and compliance

First-hand official disclosure only, plus open macro data. No material non-public information and no personal data — the TDCC holdings data is an aggregate distribution, not individual holders. Core datasets are redistributable under Taiwan's Open Government Data License, with attribution required.

Those authorities are named as data SOURCES. TWMD is not affiliated with, and is not endorsed by, any of them.

Data sources & licensing →

Access control

API keys scoped by plan entitlement, and your key stays in your environment. Sign-in supports OAuth and passkeys, CLI and agent access needs a human approval bound to a signed-in session, and read-only monitoring roles are separate from application credentials.

Access and identity detail →

Status

What is done, what is not.

We hold no security certifications. Rather than show badges we have not earned, this says where each thing actually stands — including the empty column.

Done — publicly re-checkable

  • Qualys SSL Labs A+ on all four endpoints
  • HSTS enabled (not yet on the browser preload list)
  • Verifiable proof: public endpoints plus a standard-library verifier
  • No material non-public information, no personal data in the market data
  • SIG-Lite / CAIQ-Lite self-assessment published in full (a self-assessment, not a third-party certification)

In progress

  • GDPR and privacy documentation
  • Per-dataset attribution rollout

Roadmap — not started

  • Third-party penetration test
  • SOC 2
  • ISO 27001
  • Database encryption at rest
  • Point-in-time recovery

Frequently asked questions.

1Where does TWMD's data come from?
First-hand official disclosure only — the Taiwan Stock Exchange (TWSE), the Taipei Exchange (TPEx), the Taiwan Futures Exchange (TAIFEX), the Taiwan Depository & Clearing Corporation (TDCC) and the Market Observation Post System (MOPS), plus open macroeconomic sources. We do not scrape third-party sites and we use no insider or expert-network material. Every dataset's origin and licence is recorded in the source register.
2Does the data contain personal data (PII)?
No. What we deliver is market, holdings and regulatory disclosure data, containing no personally identifying information. The TDCC holdings distribution is aggregated into bands — how many holders and how many shares sit in each band — not the identity or account of any individual holder. The data content therefore does not trigger data-subject obligations under Taiwan's personal data law or the GDPR.
3Does the data contain material non-public information (MNPI)?
No. Everything originates in disclosure the authorities have already published — material anyone can obtain from the exchanges or the Market Observation Post System. We organise it, align it in time and standardise it; there is no insider material, no expert interview and no unpublished component anywhere in it.
4How can a buyer independently verify that data has not been altered?
We publish cryptographically signed Merkle checkpoints for the data, exposed through four public proof endpoints (/v2/proof/checkpoints, /recipe, /inclusion and /public-key). You can download our standard-library script twmd_verify_proof.py and recompute the leaf yourself, walk the Merkle path and check the Ed25519 signature — at no point do you have to trust anything we say. It proves that a historical extract is the one we published and has not been altered; it does not prove that the figure is semantically correct.
5Which datasets does the verifiable proof currently cover?
We currently publish signed checkpoints for listed daily prices (twse_daily_price) and are extending coverage to further datasets. The coverage list is read live from /v2/proof/checkpoints rather than written into the page — what you see there is what genuinely exists at the moment you load it.
6Is the data point-in-time correct?
Every row of the financial datasets — monthly revenue, balance sheet, income statement and cash flow — carries a knowledge_date marking the day the figure could have been known. We set it to the statutory filing deadline, deliberately conservative because companies usually announce earlier, so filtering on it cannot leak future information. Daily prices do not currently carry that column, and as-of filtering by query parameter is a roadmap feature that is not live yet.
7How is data encrypted in transit?
TLS across the site, graded A+ by Qualys SSL Labs on all four endpoints — including HSTS, TLS 1.2 and 1.3 only, 1.0 and 1.1 refused, and no RC4. Anyone can re-run that grade publicly on Qualys.
8Is data encrypted at rest?
Backups are encrypted with age. Filesystem-level encryption at rest for the database is on the roadmap and not yet done — we list it honestly rather than claim it.
9How do backups and disaster recovery work?
Encrypted backups are taken daily and held off-site in Cloudflare R2, and a restore has been performed with the real keys. The recovery point objective today is the daily snapshot — around 24 hours in the worst case — and continuous point-in-time recovery (PITR) is on the roadmap.
10Do you hold SOC 2 or ISO 27001 certification?
We hold no formal certification today, and we do not display badges we have not earned. Controls are designed against recognised frameworks, and we can provide a pre-filled CAIQ / SIG-Lite self-assessment. The roadmap runs cheapest to costliest: SSL A+ (done) → privacy documentation → CAIQ/SIG-Lite → SOC 2 Type 1 → SOC 2 Type 2 / ISO 27001.
11Has a third-party penetration test been done?
No third-party pentest has been carried out; it sits on the certification roadmap. Day to day there is code review, static analysis and dependency vulnerability scanning; around 16 dependency CVEs are currently outstanding, and these are disclosed honestly in our security self-assessment.
12How is access control designed?
Authentication is by API key with entitlement scoped by plan, and the key stays in your own environment. Keys are managed in the database and can be revoked immediately — the next request is already refused. Internally we work to least privilege, with the read-only monitoring role separated from the application credential.
13How do accounts sign in?
GitHub OAuth, passkeys and the RFC 8628 device flow are supported. Credentials are stored only as hashes; no plaintext password is kept.
14Which subprocessors do you use?
Compute and hosting: Contabo (Japan). Edge CDN/WAF and encrypted backup: Cloudflare and Cloudflare R2. Payments: Polar, which touches billing only and never market data. Transactional email: Resend. Sign-in and analytics: Google. The subprocessor table in the Trust Center is the authoritative list.
15Do the GDPR and CCPA apply?
Because the data content of the service contains no personal data, the data-subject obligations of the GDPR and CCPA are not triggered by the data itself. Privacy documentation and a DPA covering the account and billing relationship are in preparation.
16May I redistribute or resell the data?
Most core datasets are provided under Taiwan's Open Government Data License and may be redistributed within its terms, but attribution to the originating authority is REQUIRED. Per-dataset licence status and redistribution conditions are governed by the Data Sources & Licensing page; some curated datasets — the TPEx industry value chain, for instance — are display-only and not open for redistribution.

Running a security review?

The Trust Center has the subprocessor table, the measured grades and the certification roadmap.

Trust CenterContact us