Your subscriptions are the position

Security conversations about data vendors focus on the payload, which is usually the least interesting thing in the connection. Much of what we deliver describes events that are observable by someone, somewhere, eventually - that is what makes it ground truth rather than a secret. What is never observable by anyone is which of those events a particular firm decided to watch, and on what date it started paying attention. That is not metadata about the position. In a great many cases it is the position, expressed a few weeks earlier than the trade.

This is the domain of traffic analysis: reading the shape of communication rather than its contents. Endpoints, timing, volume, and rhythm survive encryption, and for a subscription product they are unusually expressive. A firm that adds three coverage areas in a fortnight has told an observer what it is building. A query pattern that intensifies around one subject area describes a thesis forming. None of that requires breaking anything, and none of it needs to wait for a quantum computer.

Then there is the half that does wait. Harvest now, decrypt later is the practice of recording encrypted traffic today in order to read it whenever the mathematics gives way. Storage is cheap and ciphertext keeps, so the question is not whether an adversary can read it now but whether the contents will still matter when they can. For a fund, a subscription history is not perishable in the way a price is: it describes a research program, and research programs run for years.

The engineering response has two parts and neither is optional. The contents are protected by a hybrid key exchange on every hop, so a session is only readable by an adversary who defeats both a classical elliptic curve and a lattice scheme, with forward secrecy so a later key compromise cannot retroactively open what was already recorded. The details, and the standards they are specified against, are on the post-quantum security page rather than summarized loosely here.

The shape is a design decision rather than a cryptographic one, and it gets less attention than it deserves. A client that polls for exactly the entities it cares about is broadcasting a list of them to anyone watching the connection, one request at a time, with timing attached. A single long-lived stream carrying a broader subscription reveals a fraction of that: the traffic is continuous, its volume tracks the world rather than the client's attention, and the interesting inference - what specifically is being watched - is no longer sitting in a request pattern. Preferring streams to polling is usually argued on latency grounds. It is also a privacy property.

Here is what none of it achieves, stated plainly because a vendor that overclaims on security should not be trusted with anything else. An observer positioned between your firm and us can always see that you are our client, roughly how much traffic you take, and when your systems are busy. Transport security hides what you asked for, not that you asked; traffic analysis works on the remainder. Firms for whom the relationship itself is sensitive need arrangements beyond encryption, and the right response to that requirement is an architecture conversation rather than a reassurance.

The unglamorous half of the exposure sits on the client's side of the boundary and deserves its paragraph. An API key shared across a firm turns one leak into total compromise and makes it impossible to say afterwards which system did what; a key scoped to the streams one process consumes contains both. Rotation should be a routine that runs whether or not anything happened, because a credential that has never been rotated is one nobody knows how to rotate. None of this is exotic advice - it is simply the part of a security review that gets deferred because the vendor's transport is more interesting to argue about.

There is also a governance dimension that outlives any single conversation. Sessions recorded today are evidence about a firm's behavior, and a data governance review three years from now may need to establish who could have known what, and when. Being able to say what a connection negotiated, on which legs, against which published standard is part of answering that - which is only possible for a provider that owns every hop rather than subcontracting the last one.

The reason we make this argument on a marketing site rather than in a security appendix is that the audience is wrong for an appendix. This is not a CISO's problem in the first instance. It is a portfolio manager's, and it is the rare security question where the person who understands the exposure fastest is the one who would lose the most. The architecture that makes the guarantee enforceable is the same one that makes the latency claim measurable.