Every service this software sends a request to
36 upstream sources across 36 distinct hosts. This list is generated from the same source registry the terminal itself reads, so it cannot drift away from what the code does.
What actually leaves this machine
A ticker symbol, a CIK, a date range, or a document identifier — the parameters of the query you ran. Nothing else. No account identifier, no session token, and no address of yours: the request is made by the server you are running, from its address, not from your browser.
None of these providers is a subprocessor in the GDPR sense unless personal data reaches them, and this software has no path by which it could. They are listed under that heading anyway because it is the heading a security review looks under, and answering the question asked beats being technically right about the label.
- No personal data is transmitted to any entry on this list.
- No provider on this list can identify a reader of your install.
- If you configure an optional API key, that key is sent to its own provider and to no other. Which keys unlock what is on the self-hosting page.
Contacted by your browser, not by the server
Two, on three screens, and they are the exception to everything above. These requests leave your own browser, so unlike every entry in the generated list these providers do see your IP address.
- CARTO (basemaps.cartocdn.com) — map tiles on GEO and TMAP. Receives your IP address and the tile coordinates, which disclose which part of the world you are looking at. Declared in frontend/telemetry_map.js and static/geo.js.
- jsDelivr (cdn.jsdelivr.net) — the Pyodide Python runtime on the Quant Sandbox, fetched the first time you press Run and never on page load. Receives your IP address and nothing about what you are running. Declared in static/pyodide_bridge.js.
- Neither is contacted on any other screen, and neither receives a ticker, a query or an account identifier.
Filings & regulatory
Filings index, XBRL company facts, and full-text search across every US registrant.
app/services/sec.py, cf.py, fa.py, backend/edgar_fts.pyWeekly ATS and over-the-counter share volume by security.
app/services/finra.py, backend/dark_pool_live.pyRules, proposed rules and notices, used to date regulatory events.
app/services/phase8.pyFederal and state docket entries behind the litigation views.
app/services/phase8.pyDrug, device and enforcement records for healthcare coverage.
app/services/phase8.pyOFAC SDN and consolidated sanctions entries, screened against issuer and counterparty names.
app/services/sanctions.pyRates & macro
Daily par yield curve — the risk-free leg of every discounting screen.
app/services/macro_rates.pyFOMC meeting calendar and balance-sheet releases.
app/services/fed.py, events_calendar.pyMacro series. The CSV endpoints need no key; an optional FRED key unlocks the JSON API.
app/services/macro_rates.pyEuro-area policy rates and FX reference rates.
app/services/phase6.pyCross-border banking and effective exchange rate statistics.
app/services/phase6.pyNational accounts detail used in the economic calendar context.
app/services/phase6.pyMarket data
Quotes, OHLC history and fundamentals. Delayed, not a tick feed — see the limits below.
app/services/yahoo.py, hp.py, phase5.pyIndependent end-of-day history, used to cross-check the primary quote path.
app/services/market.pyIndex constituents and listing reference data.
app/services/phase5.py, splc.pyToken supply and unlock schedules for the digital-asset screens.
backend/token_supply_live.pyBloomberg-operated open security identifiers, used to enrich a symbol with its FIGI, exchange and security type.
app/services/symbology.pyGovernment & science
Federal contract and grant awards, resolved to the issuer under review.
app/services/phase8.py, backend/federal_awards_live.pyRegistered trial phases, sponsors and status changes.
backend/clinical_trials_live.pyPublication metadata behind the research-intensity views.
app/services/phase8.pyForecast and ERA5 reanalysis weather over agricultural and industrial polygons.
backend/crop_climate_live.py, micro_climate.pyCrowdsourced ADS-B aircraft positions for the corporate-jet screens.
backend/jet_activity_live.py, jet_tracker.pySeismic events on the global intelligence map.
app/services/geo.pyPublished housing price and inventory panels by metro.
backend/housing_research_live.pyNews & chatter
Worldwide event and tone stream behind the geopolitical layer.
app/services/geo.py, news.pyPublic retail message stream, used for chatter volume — never as a signal on its own.
app/services/news.py, backend/retail_chatter_live.pyHeadline feeds for the news hub, attributed per item.
app/services/news.pyAlternative data
Public app reviews for the consumer-frustration index.
backend/app_store_live.pyPublic hiring pages, read for headcount direction and stealth pivots.
backend/job_board_live.pyPublic repository activity. Unauthenticated requests are rate limited.
app/services/phase8.pyGenerated at page load from DATA_SOURCES in frontend/data_sources.js — the registry app/services/* is written against, and the one the methodology page reads.