What is actually in place today, and what we have not earned the right to claim.
Tirion is a young company. We hold no SOC 2 report, no ISO 27001 certificate, and we have not commissioned an external penetration test. Saying otherwise would be the easiest lie on this page, so we are saying it plainly instead.
What follows is what is actually in place today. If a control you need is not on this list, ask, and we will tell you honestly whether we have it.
The site and the product are served over HTTPS only. Plain HTTP requests are permanently redirected. The minimum accepted protocol is TLS 1.2, and modern clients connect over HTTP/2 or HTTP/3.
Files stored for this site are encrypted at rest by the storage provider using AES-256.
Authentication is handled by a dedicated identity provider rather than by us. We never see or store your password. That provider handles the login flow, session tokens, and multi-factor authentication where enabled on your account.
API keys and integration tokens are stored as HMAC-SHA256 hashes, never as plaintext, so a copy of our database does not yield working keys. A key that is lost can be revoked immediately.
Every key carries explicit scopes and a rate limit. Read access does not imply write access, and the tools that could change data are not exposed on customer-facing surfaces at all.
Programmatic calls are recorded with who made them, when, which tool, the outcome, the timing, and the request itself, including what you looked up. We reserve the right to log and review this activity to run the service securely and prevent abuse. What the record deliberately excludes is the substance of the results: no notes, no biographies, no source URLs, no tokens, no key material. We keep that a request happened, not a second copy of the contents it returned.
The marketing site you are reading sets no cookies, runs no analytics, loads no third-party scripts, and makes no requests to any other domain. Fonts and images come from our own servers. There is nothing here to track you with.
It is served as static files behind a content delivery network, which leaves very little to attack.
Worth stating because it changes the risk: the research data in Tirion is drawn from public records. It is not purchased from brokers and not scraped from private accounts. A breach of Tirion would be serious, but it would not expose a private dataset that exists nowhere else.
If you believe you have found a vulnerability, write to info@tiriondata.com with enough detail to reproduce it. We will confirm receipt, and we will not pursue anyone who reports in good faith and does not access or alter other people's data.
This page was last reviewed on 14 August 2026.