Security practices during controlled beta

What we do — and don’t do — today

FomoIQ is an early-stage product in a controlled beta. This page describes what is actually implemented right now, not aspirational claims.

Row-level ownership on your data

Your portfolios, holdings, and briefs are scoped to your account at the database level — a query from your session can only ever return your own rows.

Draft evidence is admin-only

Raw sources, story clusters, extracted facts, and intermediate scores are never queryable by a user session, at any stage — not just hidden in the interface, denied at the database layer regardless of a brief's status.

Only approved, sent briefs are visible to you

A brief becomes visible in your dashboard, or eligible for email delivery, only after a person has reviewed and approved it.

No wallet or exchange credentials, ever

FomoIQ does not request, store, or handle wallet private keys, seed phrases, or exchange API credentials. It cannot execute a trade, because it has nothing to trade with.

Server-side credentials only

Provider API keys and service credentials are held server-side and are never exposed to the browser.

Isolated test accounts

Internal QA and demo accounts are clearly identified as synthetic and are kept separate from real user data and real portfolios.

What we don’t claim

FomoIQ does not currently hold SOC 2, ISO 27001, or any third-party security certification, and has not undergone an independent security audit. We won’t claim “bank-grade security” or similar language until it’s actually true and verifiable. If that changes, this page will be updated to reflect it, with specifics.

Found a security issue? Contact us directly rather than filing a public report.