> Mr. Market docs. Source: https://docs.mrmarket.fyi/reference/security. Every page is listed in https://docs.mrmarket.fyi/llms.txt; append `.md` to any docs URL for its Markdown.

# Security and privacy

How assistants sign in, what they can reach, what is logged, and how to cut one off.

## Signing in

- Apps connect with **OAuth 2.1**: authorization code with **PKCE (S256)** and dynamic client registration. There are
  no API keys to paste or leak.
- The sign-in page names the app asking and where it will return you. Nothing happens until you choose **Allow**.
- Each app gets its **own** credential, bound to the Mr. Market server and to read-only research. It never sees your
  password, and it can't be used on any other site.
- Credentials last 90 days. Stored credentials are hashed.

## What an assistant can reach

- The same shared research you see on https://mrmarket.fyi: statements, filings, calls, ownership, screens, markets and macro.
- Nothing personal: no account settings, saved lists or notes, and no other member's activity.
- Every tool is read-only. None of them write, refresh or delete anything.

## Cutting one off

Disconnect an app in [Account](https://mrmarket.fyi/account). The next call it makes is refused, immediately. Other apps keep
working. If you think a device was lost, disconnect everything there and sign in again where you need it.

## What is logged

For each tool call: which tool, whether it succeeded, and how long it took, kept for 30 days. **Not** the arguments
you passed or the data returned. Sign-in events are counted for product analytics. Conversations with your assistant
stay with your assistant; Mr. Market never sees them.

## Text from documents is data

Filings, earnings call transcripts and news are third-party text. Mr. Market marks every result that contains such
text as untrusted, and its instructions tell assistants to treat it as data to quote, never as instructions. Even so,
read what an assistant proposes to do with care, as you would with any web content.

## Reporting a problem

If something looks wrong (a sign-in page you didn't start, data that seems tampered with), disconnect the app in
Account and tell the person who invited you.