SpotX
    Security

    Trust starts with what we don't do.

    SpotX is read-only by design. We never touch funds and we don't ask for permission to. Below is the full posture, written plainly.

    The shortest possible answer to 'is SpotX safe to plug into my desk?' — yes, because we're a read-only data service that never touches keys, funds, or signatures.

    At a glance
    0
    Wallet permissions requested
    0
    Private keys ever held
    4
    Sub-processors (full DPA)
    30d
    Disclosure window
    How to read this page
    01
    What we don't do
    No custody, no signatures, no tracking pixels — six plain-English commitments below.
    02
    Redundant ingest
    A multi-vendor RPC mesh with active failover, so one provider outage never drops your feed.
    03
    Vendors & disclosure
    Full sub-processor list, DPA on request, security@tryspotx.com for researchers.

    No custody, ever

    SpotX never requests, receives, or holds customer keys, funds, or wallet signatures.

    Public data only

    We exclusively process on-chain data that is publicly available and broadcast.

    Hardened infrastructure

    AWS GovCloud-equivalent posture: VPC isolation, KMS encryption at rest, mTLS internally.

    Independent audit on roadmap

    We're building toward a third-party security audit. Until then, our posture, sub-processors and incident history are documented openly below.

    Data minimization

    We collect the minimum customer data required (email, billing). No tracking, no third-party advertising pixels.

    Responsible disclosure

    Security researchers: security@tryspotx.com · PGP key on request · 30-day disclosure window.

    Availability

    Ingest runs on a multi-vendor RPC mesh with active failover on every supported chain, so a single provider outage degrades freshness rather than dropping your feed. We are pre-GA on formal uptime commitments: we do not yet publish a contractual SLA, and we would rather say so than quote a number we can't evidence. Desk-tier agreements can include a negotiated availability target.

    Sub-processors

    AWS (compute, storage), Cloudflare (edge), Stripe (payments), Postmark (transactional email). Full DPA on request.