Trust Center

"Zero-Storage" credential architecture

Global Barry API credential secrets are never stored on our backend.

• One-way hashing only. Credentials have the form bgk_<prefix>_<secret>. We keep only a SHA-256 hash of the credential and its short public prefix (used to identify the key in your dashboard). The full secret is never written to our database in a reversible form.
• Shown once. The secret is displayed a single time, at creation or rotation. It cannot be recovered, decrypted or reversed — not by you and not by us. If it is lost, revoke it and issue a new one.
• No third-party keys required. You do not hand us OpenAI or any other third-party API keys to use Global Barry. The AI features run on Global Barry's own managed inference endpoint, so there is nowhere in the product where a customer's third-party key is entered or stored.
• If you choose to supply your own credential (an enterprise option), the Bring Your Own Vault model keeps custody of that key with you.
• Sessions. Sign-in uses opaque session tokens that are stored server-side only as hashes, with double-submit CSRF protection on state-changing requests. Administrative surfaces are gated by a separate shared secret and are not linked from public navigation.

Data isolation statement

• Portfolios, watchlists and holdings you enter are stored in Global Barry's account database, scoped to your account.
• They are sent to our managed AI endpoint only transiently, for inference, when you ask the Copilot or another AI feature a question.
• Your financial data is never sold and never shared with third parties.
• Your financial data is never used to train global or foundation AI models.

Scoped-key creation guide

IT admins block API keys when they fear unrestricted access. Global Barry API credentials are issued with a read-only scope (read) and a per-key rate limit; they can be rotated or revoked at any time from the developer portal. Issue one credential per integration so each can be revoked independently (least privilege).

If your team pairs Global Barry with an external model provider of its own, restrict that key too. For example, an OpenAI project key limited to a single low-cost model (such as gpt-4o-mini), a strict monthly spend cap (such as $50), and data retention / training sharing disabled where the provider allows it.

SOC 2 Type II & ISO 27001 path

Bring Your Own Vault (BYOV)

For Tier-1 and enterprise clients whose policy rules out browser-based credential storage, Global Barry can be deployed so that keys stay in your own credential manager:

• AWS Secrets Manager
• Azure Key Vault
• HashiCorp Vault

Credentials are injected from your vault at request time, so your IT team keeps full ownership and kill-switch control — revoking or rotating the secret in your vault cuts off access immediately. BYOV is an enterprise deployment option arranged on request; it is not a self-serve one-click integration. Contact security to scope it.