Small surface. Verifiable everything.

Practices

What we do, stated plainly

Payments never touch our servers

Checkout runs on Stripe's hosted, PCI-DSS-compliant infrastructure. We never see or store card numbers — we receive only the order record and the email to deliver to.

Minimal data collection

We collect what a sale requires: your checkout email and what you bought. No third-party ad trackers, no data resale, no marketing lists without consent.

Verifiable deliveries

Every delivered file carries a sha256 checksum in its manifest. You can prove — independently, offline — that what you received is exactly what we published.

Data lands under your controls

Enterprise deliveries go into S3 or GCS buckets you own, so your existing IAM, encryption, and audit policies apply from the first byte.

Immutable published versions

Published dataset versions are never modified in place. Corrections are new versions with change logs — nothing can silently change under you.

Signed, expiring download links

Deliveries use signed URLs with limited lifetimes. Expired links are reissued on request for the same purchase, at no cost.

Public data only

Everything we sell is decoded from public blockchain state. We hold no customer datasets, no private keys, and no counterparty information beyond order records.

Hardened serving infrastructure

The application runs as a non-root process on a read-only filesystem with least-privilege defaults, behind TLS.