Security and procurement
What your security, legal and procurement teams usually ask about Unicorn Data, answered in one page.
Where the data is
The service runs on Cloudflare (Workers and D1 database). Account data is stored by Cloudflare and processed in its network. Payment data is handled only by Stripe and never reaches our systems.
What we hold
Only what the service needs: your work email, plan, usage counters, webhook URLs and delivery results. The dataset contains no personal data of Unicorn Watch users: community forecasts are shared only as aggregate statistics, from 5 votes.
Encryption
All traffic uses HTTPS with TLS 1.2 or higher. Data at rest is encrypted by the storage provider. API keys, sign-in links and sessions are stored only as SHA-256 hashes; a new key is shown once.
Access
Access with single-use email links valid for 20 minutes and sessions of 30 days, no passwords. Rotating the API key revokes the previous one at once. The widget key can be limited to your domains. Each customer's data is separated by account.
Retention
Account data is kept while the account exists and up to 24 months after the end of the last subscription; usage counters for 24 months; webhook delivery logs for 90 days. Invoices are kept as tax law requires.
Widget visitors
The widget sets no cookies and uses no identifiers. We do not store the IP address of the visitors of your site; we count only the number of loads per customer.
Webhooks
Every delivery is signed with HMAC SHA-256 and a timestamp, so you can check the origin and reject replays. Only public HTTPS endpoints are accepted.
Availability
There is no contractual SLA. The state of the API and of the data source is public on the status page.
Certifications
Unicorn Private LLC does not hold its own certifications such as SOC 2 or ISO 27001. Our infrastructure providers publish their own certifications on their websites.
Sub-processors
- Cloudflare, Inc. (hosting, database, email delivery of sign-in links)
- Stripe, Inc. (payments, invoices, tax IDs)
We publish changes to this list on this page before they take effect.
Security questionnaire
A standard security questionnaire, already filled in, is available to download. Your team can use it directly in its vendor assessment.
Documents
The terms of service and data licence are accepted online when you subscribe, and personal data is handled under the privacy notice of Unicorn Private LLC. There is no separate contract to sign.