Security you can verifyrather than take on faith.
Finny is built so the sensitive parts of your workflow never need to leave your control. This page documents where the software runs, what data moves, and who to contact during a vendor review.
The software runs on your machine
The Finny CLI executes locally. Strategy code, market data pulls, and backtests run in your environment, not on our servers.
Your keys stay yours
Broker credentials and model API keys are read from your local configuration or environment. They are not transmitted to Finny and we cannot read them.
We do not collect trading data
Positions, orders, strategy source, and research context are not sent to Finny as part of normal operation.
Enterprise deploys inside your boundary
Enterprise installs run in your own VPC, cloud account, or on-prem host, and connect only to systems you approve.
Generated code is inspectable
Every strategy Finny produces is readable Python you can review, diff, and version before it touches a broker.
Minimal service-side data
Licensed installs verify entitlement using a one-way hash of the license key and a device identifier. That check carries no trading data.
Data flow
What leaves your network, by surface.
| Surface | Where it runs | What leaves your network |
|---|---|---|
| Finny CLI (open source) | Your machine | Nothing by default. Model calls go directly from your machine to the provider you configured. |
| Licensed finny-pro | Your machine | A hashed license key and hashed device identifier, for entitlement checks only. |
| Finny Cloud | Your cloud or VPC | Nothing to Finny. Sessions stay inside the environment where Cloud is deployed. |
| Billing | Stripe | Email and payment details handled by Stripe. We never store full card numbers. |
| This website | Vercel | Contact form submissions you choose to send, plus standard hosting logs. |
Security posture
- Deployment model
- Local-first CLI; enterprise runs in your own infrastructure
- Credential handling
- Broker and model keys stay in your local config
- Data residency
- Determined by your deployment, not by us
- Payment processing
- Stripe; no card numbers stored by Finny
- Source availability
- Core CLI is open source and auditable
- Subprocessors
- Stripe (billing), Vercel (website hosting)
Finny is an early-stage company and does not yet hold a SOC 2 attestation. We will say so directly rather than imply coverage we do not have. If your review requires formal certification, raise it on the scoping call so we can tell you where we stand.
Legal documents
Security contact
Reporting a vulnerability?
Email us directly and we will acknowledge your report. Please include reproduction steps and give us a reasonable window to respond before disclosing publicly.
jaimin@finnyai.techRunning a vendor review for a trading desk? Book a scoping call and we will work through your questionnaire.