Security | RealMarketAPI

Security

Last updated: April 7, 2026

1. Infrastructure Security

All traffic is encrypted in transit using TLS 1.2 or higher.
Services are hosted on hardened cloud infrastructure with network-level isolation and DDoS protection.
Environments are separated — production, staging, and development are fully isolated.
Access to production systems is restricted to authorized personnel only, using role-based access controls.

2. Application Security

Input validation and output encoding are applied throughout the application to prevent injection attacks.
Rate limiting is enforced on all API endpoints to prevent abuse and brute-force attacks.
Security headers (CSP, HSTS, X-Frame-Options, etc.) are applied to all HTTP responses.
Dependencies are regularly audited and updated to address known vulnerabilities.

3. Authentication & API Keys

Passwords are hashed using a strong, salted algorithm. Plain-text passwords are never stored.
API keys are generated with cryptographically secure random number generation.
API keys are hashed at rest. Only you see the full key on creation — we cannot retrieve it for you.
You can revoke and regenerate API keys from your dashboard at any time.

4. Data Protection

We never store payment card numbers, CVVs, or sensitive payment instrument details. Payments are processed entirely by Dodo Payments.
Data at rest is encrypted using industry-standard encryption.
Access to user data is restricted to personnel who require it to provide the service.
Audit logs are maintained to track access to sensitive data.

5. Operational Security

System health and anomalous activity are continuously monitored via automated alerting.
Security patches are applied promptly following disclosure of critical vulnerabilities.
Regular backups are performed and tested for recoverability.
An incident response process is in place to handle and communicate security events.

6. Customer Best Practices

To keep your account and API keys secure, we recommend:

Use a strong, unique password and enable two-factor authentication where available.
Never share your API key publicly or commit it to version control.
Store API keys in environment variables or a secrets manager, not in code.
Rotate your API key immediately if you suspect it has been compromised.
Restrict API key permissions to only what your application requires.

7. Responsible Disclosure

If you discover a security vulnerability, please report it to us responsibly. Contact us via the contact page with a detailed description of the issue. We will acknowledge your report promptly and work to address confirmed vulnerabilities. We ask that you do not publicly disclose vulnerabilities until we have had a reasonable opportunity to remediate them.

1. Infrastructure Security

All traffic is encrypted in transit using TLS 1.2 or higher.

Services are hosted on hardened cloud infrastructure with network-level isolation and DDoS protection.

Environments are separated — production, staging, and development are fully isolated.

Access to production systems is restricted to authorized personnel only, using role-based access controls.

2. Application Security

Input validation and output encoding are applied throughout the application to prevent injection attacks.

Rate limiting is enforced on all API endpoints to prevent abuse and brute-force attacks.

Security headers (CSP, HSTS, X-Frame-Options, etc.) are applied to all HTTP responses.

Dependencies are regularly audited and updated to address known vulnerabilities.

3. Authentication & API Keys

Passwords are hashed using a strong, salted algorithm. Plain-text passwords are never stored.

API keys are generated with cryptographically secure random number generation.

API keys are hashed at rest. Only you see the full key on creation — we cannot retrieve it for you.

You can revoke and regenerate API keys from your dashboard at any time.

4. Data Protection

We never store payment card numbers, CVVs, or sensitive payment instrument details. Payments are processed entirely by Dodo Payments.

Data at rest is encrypted using industry-standard encryption.

Access to user data is restricted to personnel who require it to provide the service.

Audit logs are maintained to track access to sensitive data.

5. Operational Security

System health and anomalous activity are continuously monitored via automated alerting.

Security patches are applied promptly following disclosure of critical vulnerabilities.

Regular backups are performed and tested for recoverability.

An incident response process is in place to handle and communicate security events.

6. Customer Best Practices

To keep your account and API keys secure, we recommend:

Use a strong, unique password and enable two-factor authentication where available.

Never share your API key publicly or commit it to version control.

Store API keys in environment variables or a secrets manager, not in code.

Rotate your API key immediately if you suspect it has been compromised.

Restrict API key permissions to only what your application requires.

7. Responsible Disclosure