Datakoot › Security

Security and Data Handling

This page exists so a security reviewer can finish in ten minutes. Every claim on it describes code that is deployed right now, and most of them can be checked from outside without asking us anything.

Report date: 2 September 2026 · Contact: [email protected] · security.txt

What Datakoot is

Nine read-only MCP servers that give an AI agent live access to public authoritative data. There is no proprietary model and no black box to assess: every answer is a shaped response from a named upstream source. Datakoot holds none of your files, none of your documents, and no account data for free-tier use.

What we store, exactly

One database table, with four columns, shared by all nine servers:

Column	What it holds
k	A keyed, truncated identifier for the caller. Never an address, never a key.
period	The UTC day (free tier) or billing month (paid) the count belongs to.
n	A number. How many calls.
updated	A Unix timestamp, used only to enforce deletion.

That is the whole record. There is no second table, no log of requests, and no analytics store behind it.

What we never store

The query. The CVE identifier, the ticker, the domain, the package name, the coordinates — these exist for the milliseconds it takes to answer and are never written anywhere.
The caller’s network address. See below.
The licence key. Paid metering keys on a keyed hash of the key, not the key.
A name, an email, or an account for free-tier use. The free tier has no signup because there is nothing to sign up for.

How the caller identifier works

The identifier is HMAC-SHA-256 keyed with a 256-bit secret, truncated to 96 bits. The secret lives only in the server’s environment and is never stored beside the data it protects.

The keying matters, and we want to be specific about why. A plain SHA-256 of an IPv4 address is not anonymisation: there are only about 4.3 billion addresses, so anyone holding the code and the table could hash all of them and recover the original in minutes. Keyed with a secret, that attack does not work. Datakoot used a plain hash until 2 September 2026 and now does not. We are telling you this rather than describing only the current state, because the version history is the sort of thing a reviewer should not have to discover.

Retention

Call counters are deleted no later than 90 days after a caller’s last call. This is not a policy statement — it is a scheduled job that runs daily at 04:17 UTC and executes a delete against the shared table. One job covers all nine servers.

Authentication

Paid access is a bearer licence key on the Authorization header, validated against Polar, our merchant of record. A key that has been revoked, disabled or refunded stops working; validation checks the returned status rather than merely that the key exists. The key is never written to storage in any form other than a keyed hash.

Where the data comes from

For a government reviewer this is usually the most important table on the page, because several of these are your own agencies.

Server	Upstream source
Security Intel	NIST NVD, CISA KEV, OSV.dev, URLhaus, AbuseIPDB
Package Intel	npm, PyPI, crates.io, OSV.dev
Filings Intel	U.S. SEC EDGAR
Market Intel	European Central Bank reference rates
Economy Intel	World Bank, U.S. Bureau of Labor Statistics
Weather & Geo	NOAA / National Weather Service, USGS, U.S. Census geocoder
Domain & Company	RDAP, DNS, Certificate Transparency logs
Regulatory Intel	U.S. Federal Register
Base Intel	Base network RPC

Transport and browser security

Verifiable from outside with curl -I:

TLS only. HSTS with includeSubDomains and preload, one year.
A real Content-Security-Policy with frame-ancestors ’none’, object-src ’none’ and base-uri ’self’.
X-Content-Type-Options: nosniff, X-Frame-Options: DENY, Cross-Origin-Opener-Policy: same-origin.
A Permissions-Policy denying camera, microphone, geolocation, payment, USB and sensors.

Architecture

Everything runs on Cloudflare Workers at the edge. There are no virtual machines, no containers and no operating system of ours to patch, and no origin server behind the edge to reach. Nothing of yours is at rest anywhere except the four-column counter described above.

Availability

All nine servers are probed every fifteen minutes; a change in the set of unhealthy servers raises an alert immediately. Over the three days to 2 September 2026, Cloudflare’s own analytics recorded zero errors across every worker in the account.

Subprocessors

Two, and no others:

Cloudflare — compute, DNS, edge delivery, and the counter database.
Polar — merchant of record for paid plans; holds billing details and issues licence keys. Card data never touches Datakoot.

Site analytics are Cloudflare Web Analytics, which Cloudflare states uses no cookies and no fingerprinting. There are no third-party trackers, no advertising, and no sale or sharing of usage data. Ever, and not as a policy we could quietly change — there is no stored data to sell.

FedRAMP

Datakoot does not hold a FedRAMP authorization and does not claim an exemption from anyone’s policy. Here is the honest position, in a form you can verify rather than take on trust:

Datakoot stores no federal information. Queries are public identifiers — a CVE number, a package name, a ticker, a domain — and are not retained. Responses come from public authoritative sources. Whether that places a purchase inside your agency’s FedRAMP policy is your determination, not ours, and we will answer any questionnaire in full and in writing.

Accessibility

A full Accessibility Conformance Report in VPAT® 2.5 structure, covering WCAG 2.1 Level A and AA and the Revised Section 508 Standards, is published at datakoot.com/accessibility. All 31 pages were tested, not a sample. It is a vendor self-assessment and says so.

Reporting a vulnerability

Email [email protected], or use the contact in /.well-known/security.txt. It reaches the person who wrote the servers, not a queue. There is no paid bounty programme, and no action will ever be taken against anyone who reports a real issue in good faith.