Four layers around the data.
Encryption at rest and in transit, company-by-company membership checks on the server, and an audit trail of key actions. The platform was built around the handling requirements for material non-public information rather than retrofitted to them.
Server-side enforcement on every layer. Every layer independently auditable.
Multi-tenant isolation
Company-by-company membership checks on the server.
Encryption
Data is encrypted at rest by our database and file storage provider (AES-256) and in transit over TLS.
AI services
AI features run through business AI services from Google and Anthropic.
Audit trail
Key actions, such as filing marks, approvals and changes to governance records, are recorded with who did them and when. Deleted items go to a trash for 30 days before they are purged.
MNPI goes to AI only through named providers.
AI features run through business AI services from Google and Anthropic.
The platform is a tool. Counsel signs.
Market Fortress drafts, surfaces, and routes. It does not file. The signing attorney remains the responsible party on every submission, with a complete record of what was reviewed, when, and by whom.
AI drafts only. Counsel signs.
Every Concierge-drafted section moves to a counsel review state before it locks. No filing leaves the platform without an explicit counsel sign-off recorded in the audit trail.
Frozen Vault snapshot per section.
The Vault state at draft time is hashed and stored alongside the section. Counsel can replay the exact context the AI used, line by line, months after the fact.
Privilege labels.
Comments from counsel can carry a privilege label, so they can be handled apart from general notes.
Full data extraction at exit.
On contract termination the issuer can extract the complete dataset (32 tables, JSON and CSV) at any time. There is no lock-in at the data layer.
Monitoring.
We monitor the service and its scheduled jobs, and we tell affected customers directly about an outage.
For specific contractual language on liability, indemnification, or service-level commitments, request the master subscription agreement at ace@marketfortress.app.
Vulnerability Disclosure Policy
If you discover a vulnerability in the Market Fortress platform, we want to hear from you. We follow coordinated disclosure and will acknowledge every report within 2 business days.
Acknowledge in 2 business days
Every report receives an acknowledgment. We will confirm receipt and assign an internal ticket number.
Triage within 7 calendar days
We will assess severity, scope, and exploitability and communicate a remediation timeline.
Safe harbor for good-faith researchers
Market Fortress will not pursue legal action against researchers who comply with this policy and limit testing to their own accounts.
What to include in your report
A clear description of the vulnerability and its potential impact. The affected URL, endpoint, or component. Step-by-step reproduction instructions, including any payloads or request/response samples (do not exploit beyond what is necessary to demonstrate the vulnerability). Your name or handle if you wish to be credited.
Out of scope
Denial-of-service attacks. Social engineering of employees or customers. Physical security testing. Attacks requiring a compromised device or MitM certificate. Findings from automated scanners without demonstrated exploitability. Self-XSS and clickjacking on non-sensitive pages. Third-party services not directly operated by Market Fortress (Supabase, Vercel, Stripe, Resend, Google Cloud, DocuSign, Plaid).
Coordinated disclosure
Please notify us before publishing or sharing findings. We ask for a minimum of 90 days from acknowledgment before public disclosure, unless we agree to a shorter timeline. We will credit researchers by name or handle in our advisories unless you prefer anonymity.
Scope
In scope: marketfortress.app and all subdomains, the Market Fortress REST API (v1), the TypeScript SDK (@marketfortress/sdk), authentication flows, data isolation controls. Contact us if you are uncertain whether a specific testing activity is in scope before proceeding.
Prefer email? Send reports directly to ace@marketfortress.app. The full policy is available in SECURITY.md.
Have a security question?
We read every security report, and we answer vendor risk questionnaires on request.