Log in

Legal

Security

Last updated: 15 October 2026.

This page describes how the Finance Calendar API, operated by Search Ventures Pty Ltd (ACN 639 906 353) as trustee for the Ahlgren Trust, protects your account and the data it serves.

Infrastructure

  • The API and website run on Cloudflare’s network, with its protection against denial-of-service attacks.
  • All traffic is encrypted in transit with TLS.
  • Account data is kept in Cloudflare’s database service, and archived copies of official sources in its object storage, encrypted at rest by Cloudflare.
  • The website sends a strict Content Security Policy and other security headers, and cannot be framed by other sites.

API keys, sign-in and sessions

  • API keys and sign-in links are random 256-bit secrets. Keys, links and sessions are stored only as SHA-256 hashes, so a copy of our database would not reveal them. Query strings, which can carry a key, are removed from our request logs.
  • A key is shown once, when it is created. Revoking a key stops it from working within a minute.
  • Sign-in links work once and expire after 15 minutes. Requests for links are rate limited by email address and by IP address.
  • Sessions are HttpOnly, Secure cookies that expire after 30 days. You can log out of all devices from the dashboard.
  • Account and billing requests are accepted only from our own website.

Payments

Payments are handled by Stripe, a PCI DSS Level 1 certified provider. Card details are entered on Stripe’s pages and never reach our servers. Stripe’s notifications to us are verified by signature before they change anything.

Data integrity

  • Every official source behind verified data is archived with a SHA-256 hash of its content, so the evidence for a date can be checked later.
  • Official sources are checked daily. A change is reviewed by a person before it is published.
  • Each data release is listed in the changes feed with the dates it added, removed or changed.

Operations

  • Secrets such as payment keys are kept in Cloudflare’s secret storage, never in our source code. A pre-commit check refuses code that contains a payment key.
  • Access to production systems is limited to the people who run the Service.
  • Availability is published on our status page.

Reporting a vulnerability

If you think you have found a security problem, tell us through the contact form, choosing “Security report”. Include enough detail for us to reproduce it.

Please give us reasonable time to fix the problem before telling anyone else. Do not access or change data that is not yours, degrade the Service for others, or use social engineering. We will not take legal action over research done in good faith within these limits.