Security

Last updated: September 1, 2026

CommercialView holds documents that brokers have not published yet, along with the client links they send out. This page explains what protects that material and, just as plainly, what we do not do yet.

Reporting a vulnerability

If you have found a security problem, please tell us through our contact form. That form reaches a person, which is why we do not publish an email address here. If you prefer machine-readable details, they are at /.well-known/security.txt.

We read every report that arrives. We have chosen not to publish a response-time commitment, because we would rather tell you that than promise a number we are not yet staffed to meet, and we will not pursue anyone who reports a genuine issue in good faith.

What protects your material

Your material is separated from every other broker's. When a request arrives for something that is not yours, we answer as if it does not exist rather than refusing it, so that nothing is given away by the shape of the denial. Documents are processed before they can be shared, and that processing is fail-closed: a document that has not finished is never served to a client, and if anything goes wrong the file is quarantined instead of released.

Accounts are protected at the point where most of them are lost, which is signing in. We check passwords against known breached credentials and refuse the weak ones, repeated failures lock the account rather than letting someone keep guessing, and changing a password ends every other session immediately. Behind that, the application itself runs with the least it needs: an unprivileged user, its own code read-only to it, and no ability to read the file that holds its credentials.

What happens to your material is written down in a way that cannot be edited quietly, because each entry in the log is cryptographically linked to the one before it, so a removed or altered entry becomes detectable rather than invisible. The software we build on is watched too: advisories affecting installed packages are checked automatically and carry a written window for acting on them.

None of that would mean much if it were only true on the day we shipped it, so the checks run every hour rather than at release time, and a check that cannot answer its question says so instead of reporting success.

What we do not do

We would rather be exact about the gaps than imply we have none. We hold no third-party security certification: we are building toward the controls one requires, but we have not been audited against one and do not claim to have been. Two-step sign-in is not available yet either, so the passwords, lockout and session controls described above are what protect an account today.

One thing is worth knowing if you receive a link from a broker rather than an account with us: that link is itself the credential. Anyone holding it can open what it points to unless the broker has set a password on it, so it is worth treating like a key when you forward it.

Data you can ask us about

If you want to know what we hold about you, or want it deleted, the same contact form is the way to ask. What we collect and why is set out in the privacy policy.