> ## Documentation Index
> Fetch the complete documentation index at: https://docs.allocait.app/llms.txt
> Use this file to discover all available pages before exploring further.

# Security

> What Allocait does and never does with your data

Allocait is a product of Kangaroo Labs LLC, an Arizona limited liability company doing business as RidgeXAI.

## Data isolation

Database rules limit each account to its own rows.

## What Allocait never does

* **Never places a trade.** Every tool that changes your holdings only updates Allocait's own record of what you hold, after you tell it about something that already happened.
* **Never approves or stops an order.** A change check states facts about your own rules. Allocait cannot approve, stop or place an order.
* **Never connects to a brokerage or bank account.**
* **Never holds your funds or securities.**
* **Never sends an agent a price from its own data.** Every price used to check or size a change is one the caller supplied. The agent surface returns no quote, day change, position value or portfolio total. A connection you sign in to yourself can also return `standing`, which carries no price. See [Standing](https://docs.allocait.app/concepts/standing.md) and [Prices](https://docs.allocait.app/concepts/prices.md).

These describe what Allocait does, whether you use the app directly or through Claude or another agent.

## Market data

The app's prices are protected on both sides: what reaches your screen, and what reaches the data provider.

* **Only Allocait's servers author prices.** The app receives price updates on a private channel. A signed-in browser with access to the app can read the channel but isn't permitted to publish to it, so a browser has no way to push a price into your view. The app also validates each update before it uses it.
* **Your browser never calls the provider.** Prices come from Allocait's own stored quotes, so your browser holds no provider key. The provider, [Twelve Data](https://twelvedata.com), receives only ticker symbols. It never receives your account information, holding sizes, or other portfolio data.
* **Symbol checks are limited.** Allocait checks a symbol against its own list of supported instruments before anything goes to the provider, so made-up symbols don't reach it. Symbol checks and live price registration have per-account limits.
* **Quotes can go stale.** If the provider is unavailable or rate-limited, Allocait pauses its calls and the app keeps showing the last stored quote, which is labeled **Stale** once it is old.

## Policies

* [Privacy policy](https://allocait.app/privacy)
* [Terms of service](https://allocait.app/terms)

## Related

> [card] [Keys and apps](https://docs.allocait.app/security/keys-and-apps.md)
>
> How API keys and connected apps are stored, scoped and revoked.

> [card] [Report a vulnerability](https://docs.allocait.app/security/disclosure.md)
>
> How to report a security issue.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.