Security practices during controlled beta
What we do — and don’t do — today
FomoIQ is an early-stage product in a controlled beta. This page describes what is actually implemented right now, not aspirational claims.
Row-level ownership on your data
Your portfolios, holdings, and briefs are scoped to your account at the database level — a query from your session can only ever return your own rows.
Draft evidence is admin-only
Raw sources, story clusters, extracted facts, and intermediate scores are never queryable by a user session, at any stage — not just hidden in the interface, denied at the database layer regardless of a brief's status.
Only approved, sent briefs are visible to you
A brief becomes visible in your dashboard, or eligible for email delivery, only after a person has reviewed and approved it.
No wallet or exchange credentials, ever
FomoIQ does not request, store, or handle wallet private keys, seed phrases, or exchange API credentials. It cannot execute a trade, because it has nothing to trade with.
Server-side credentials only
Provider API keys and service credentials are held server-side and are never exposed to the browser.
Isolated test accounts
Internal QA and demo accounts are clearly identified as synthetic and are kept separate from real user data and real portfolios.
What we don’t claim
FomoIQ does not currently hold SOC 2, ISO 27001, or any third-party security certification, and has not undergone an independent security audit. We won’t claim “bank-grade security” or similar language until it’s actually true and verifiable. If that changes, this page will be updated to reflect it, with specifics.
Found a security issue? Contact us directly rather than filing a public report.