It's legal issue, not a technical one. I'm quite sure that from a technical perspective it's totally possible for Q to see your code.

Hello Pravin,

I'm going to start with some things that you already know for the benefit of other readers.

We are committed as a company to protect your intellectual property and to keep it private. We do not look at your code except for specific, rare exceptions that are explained in our terms of use. The exceptions include when a community member's algorithm is believed to be threatening our site security or we need to comply with any legal or regulatory requirements. Also, of course, sometimes members explicitly grant us permission to look at their code for technical support or other reasons.

Your code is on our servers. That's a necessary and important part of how Quantopian works. We provide clean data sources, computing power, code execution, broker integration, education, support, and more. Quantopian does all of these things without looking at your code. That's all possible because of the way our platform is implemented.

For this all to work, it requires trust. We've known from the very beginning that trust is vital. If we were to lose the trust of our community, our business would fail. We work to earn your trust every day. We commit to be transparent and open in how we do business. We are open about who we are (Find us on LinkedIn! See who we know in common) and about what we do.

For long-term community members, that will all sound familiar. And Pravin asked a different question that I'd like to answer. "What controls are in place at Quantopian so that a random employee cannot access our code?" I interpret that question to be about what internal controls we have in Quantopian for our internal employees. The controls are multi-layered, as most security systems are. Here are some of the relevant ones:

• All code (algorithms, backtests, notebooks, etc.) is stored in encrypted form. Access to the decryption key is very carefully controlled and limited to a few key Quantpian employees. The key is periodically rotated.
  
• The access to the databases/datastores of the encrypted code is carefully controlled and limited to a few key Quantpian employees. Credentials are periodically rotated.
  
• Access to production servers is obviously controlled in similar ways.
  
• We hire a third party to do background checks on all new Quantopian hires.
  
• We hire a third party security firm to evaluate and test our security.
  
• We have a method for support people to see a community member's code when the community member permits it. That ability is restricted to people giving support (like Jamie and me). When that power is exercised it is logged and periodically double-checked.

We regularly evaluate and improve these protocols. As our team, our community, and our product has evolved, we've made a number of improvements. One of the improvements that we've got in-progress right now is a way to give community members more control and visibility of their interaction with support. We're working on a way to give access to one algorithm at a time, that is granted for an explicit period of time, and can be revoked by the community member. That will be a further protection for community members.

I hope that helps to answer your question.

Thanks Dan. I trust Quantopian else I wouldn't be spending so much time here. I guess this industry is paranoid and your answer helps a lot in comforting anyone with similar questions.

Dan -

What about the client side? There's a vulnerability there, too. Is there anything about the code that runs in the browser that ensures that there are not leaks? I guess if you are using https, it is as secure as anything else that is cloud-based.

Grant

Grant - The bullets I listed earlier were particularly relevant for the specific question Pravin asked about "random employees accessing code." For browser security, I'd write a different list. Some of the relevant additional ones:

• SSL encryption of browser connection (as you suggest)
  
• anti-CRSF protocols
  
• email notification of unusual (new) authentication events
  
• two factor authentication support
  

Thanks Dan -

I'd also contribute that over the years, my impression is that Quantopian has been very proactive and transparent about security concerns.

Generally, my impression is that information security is a super-challenging area of IT, particularly when you have everything wired up to the cloud. Good luck!

Grant