Security and trust

Every figure is public government data, served unchanged, with the source attribution on every response. Here is exactly where the data comes from, what we store, and how to report a vulnerability.

Data provenance

Each figure is served unchanged in its native scale. We do not invent, smooth, or re-base values. There are nine named sources, each used under its own Creative Commons licence, and the attribution for each response travels with it in the meta block of the envelope.

Source	Agency	Licence
ABS	Australian Bureau of Statistics	CC-BY 4.0
RBA	Reserve Bank of Australia	CC-BY 4.0
ATO	Australian Taxation Office	CC-BY 3.0 AU
APRA	Australian Prudential Regulation Authority	CC-BY 3.0 AU
AIHW	Australian Institute of Health and Welfare	CC-BY 3.0 AU
ASIC	Australian Securities and Investments Commission	CC-BY 3.0 AU
AEMO	Australian Energy Market Operator	AEMO Copyright Permissions
WGEA	Workplace Gender Equality Agency	CC-BY 3.0 AU
AU-WEATHER	Weather (Open-Meteo, BOM-aggregated)	CC-BY 4.0

Every response carries source, source_url, attribution, licence and retrieved_at in its meta, so the provenance of any number is one field away. The full list of datasets per agency lives on the sources page.

Reporting a vulnerability

If you find a security issue, we want to hear about it before anyone else does. Email [email protected] with enough detail to reproduce the problem. We will acknowledge your report, work with you on a fix, and credit you if you would like the credit.

Our machine-readable policy follows RFC 9116 and lives at /.well-known/security.txt. Please give us a reasonable window to remediate before any public disclosure, and do not run tests that degrade service for other users or access data that is not yours.

Data handling and privacy

The account model is deliberately small. We store as little as possible, so there is little to leak.

The only personal detail we store is the email address you use to mint a key. That is what POST /v1/register takes, and it is all we keep.
The free tier takes no card. There is no payment detail on file unless you choose to upgrade to a paid plan, where billing is handled by our payment processor.
Your API key is a bearer token. Anyone holding it can call the API as you, so treat it like a password: send it only over HTTPS in the Authorization: Bearer ... header (never in a URL or query string, where it can land in logs), keep it out of public repositories and client-side code, and rotate it if it is ever exposed.
The data you query is public government data. Your requests are not the product, and we do not sell them.

Reliability by contract

A data API should never hand you a stale number while presenting it as fresh. When a source is reachable and current, you get the current data; when it is not, you get a clear 503, not a stale vintage presented as live. That keeps the failure mode visible instead of silent, so a bad number cannot reach your downstream systems unnoticed. Liveness of the API itself is exposed at the /v1/health endpoint.

Get a free key and inspect the meta block on your first response to see the attribution for yourself. The docs cover the full envelope.