Legal
Compliance
📜 Data Lineage Standard
Every record returned by the Borsat API — whether a price bar, corporate action, or announcement — carries a mandatory set of lineage fields. These fields allow your compliance and audit teams to trace any data point back to its original source, applicable license, and ingestion event.
Lineage fields on every API response
| Field | Type | Description |
|---|---|---|
| source_exchange | string | ISO short code of the originating exchange (e.g. QSE, TADAWUL) |
| mic | string | ISO 10383 Market Identifier Code (e.g. XQAT) |
| license_id | integer | Internal identifier of the exchange data license under which this record is distributed |
| ingested_at | ISO 8601 datetime | UTC timestamp when the record was received and validated by Borsat |
| dataset_version | semver string | Schema and processing version of the dataset (e.g. 1.0.0) |
| vendor_id | string | Identifier of the upstream data vendor or direct exchange feed |
| adj_factor | float | Cumulative adjustment factor applied for splits and dividends (EOD bars only). Raw price × adj_factor = adjusted price. |
Bulk CSV exports include all lineage columns. Parquet files include full column-level metadata in the Parquet schema. These fields cannot be removed or omitted by API configuration.
🔒 Entitlement Model
Borsat enforces a default-deny access model. Every API key is associated with a client account. Each client account holds a set of entitlements that explicitly grant access to specific (MIC, dataset, access_right) tuples. Any request against a MIC or dataset not covered by an active entitlement is rejected with BORSAT_ACCESS_DENIED.
Access decision flow
(MIC + dataset + right)
Entitlement dimensions
| Dimension | Values | Notes |
|---|---|---|
| MIC | XQAT, XSES, XDFM, XADS, XKUW, XMUS, XBAH, XCAI, XAMM, XCAS, XTUN, XPAL, XISX | One entitlement per exchange. GCC bundle available. |
| Dataset | eod_bars, tick_data, corporate_actions, announcements, fundamentals, order_book | Entitlements are per dataset, not all-or-nothing per exchange. |
| Access Right | internal_use, redistribution, derived_data | Redistribution requires explicit exchange approval. |
🏛️ Exchange Licensing by MIC
Borsat sources data under data distribution agreements with each exchange or licensed vendor. The table below summarises the licensing status, attribution requirements, and redistribution rights for each covered exchange.
| Exchange | MIC | Country | Currency | EOD Bars | Corp. Actions | Attribution Required |
|---|---|---|---|---|---|---|
| Qatar Stock Exchange | XQAT | QA | QAR | Licensed | Licensed | Yes — "Source: QSE" |
| Saudi Exchange (Tadawul) | XSES | SA | SAR | Licensed | Licensed | Yes — "Source: Tadawul" |
| Dubai Financial Market | XDFM | AE | AED | Licensed | Licensed | Yes — "Source: DFM" |
| Abu Dhabi Securities Exchange | XADS | AE | AED | Licensed | Licensed | Yes — "Source: ADX" |
| Boursa Kuwait | XKUW | KW | KWD | Licensed | In Progress | Yes — "Source: Boursa Kuwait" |
| Muscat Stock Exchange | XMUS | OM | OMR | Licensed | In Progress | Yes — "Source: MSM" |
| Bahrain Bourse | XBAH | BH | BHD | Licensed | In Progress | Yes — "Source: Bahrain Bourse" |
| Egyptian Exchange | XCAI | EG | EGP | In Progress | Pending | Yes — "Source: EGX" |
| Amman Stock Exchange | XAMM | JO | JOD | In Progress | Pending | Yes — "Source: ASE" |
| Casablanca Stock Exchange | XCAS | MA | MAD | In Progress | Pending | Yes — "Source: CSE" |
| Bourse de Tunis | XTUN | TN | TND | Pending | Pending | Yes — "Source: BVMT" |
| Palestine Exchange | XPAL | PS | ILS | Pending | Pending | Yes — "Source: PEX" |
| Iraq Stock Exchange | XISX | IQ | IQD | Pending | Pending | Yes — "Source: ISX" |
📊 Dataset Definitions
| Dataset ID | Description | Update Frequency | History Available |
|---|---|---|---|
| eod_bars | End-of-day OHLCV prices with split/dividend adj_factor | Daily (post-close) | From exchange inception |
| tick_data | Individual trade ticks and best bid/ask quotes, µs precision | Real-time | Rolling 12 months |
| corporate_actions | Dividends, splits, rights, mergers, delistings | Within 1 hour of announcement | From exchange inception |
| announcements | Regulatory filings, earnings, board resolutions | Real-time (exchange feed) | 5 years rolling |
| fundamentals | 50+ financial metrics from audited statements | Per reporting period | 10 years annual, 5 years quarterly |
| order_book | L2 order book snapshots (bid/ask depth) | Real-time | Rolling 30 days |
📋 Permitted Use Policy
Internal Use — All subscription tiers include rights to use data for internal portfolio management, risk analysis, research, and investment decision-making within the subscribing legal entity.
Derived Data — Clients may create derived works (indices, analytics, models) from licensed data provided the underlying data is not directly reconstructible from the output. Derived data rights are included in the Professional and Enterprise tiers.
Redistribution — Direct redistribution of raw exchange data to third parties requires explicit redistribution rights, which must be negotiated separately with Borsat and the originating exchange. Redistribution without a license is a material breach of the agreement.
AI and Machine Learning — Using licensed data to train, fine-tune, or evaluate machine learning models constitutes internal use provided the model is used solely for the subscribing entity's own investment activities. Training models for resale or external distribution requires an enterprise license.
🧾 Audit Trail Architecture
All API calls are logged in a tamper-evident access log with the following fields. Enterprise clients can request a raw export of their access log for up to 24 months, suitable for regulatory reporting and internal compliance audits.
| Field | Description |
|---|---|
| timestamp | UTC request timestamp (millisecond precision) |
| client_id | Subscribing entity identifier |
| api_key_id | Hashed identifier of the API key used (key value never stored) |
| endpoint | API endpoint path and HTTP method |
| mic | Exchange MIC accessed |
| dataset | Dataset type accessed |
| records_returned | Count of records in the response |
| response_ms | Server-side response latency |
| ip_address | Client IP (hashed for GDPR compliance) |
⚠️ Compliance Error Codes
All access denials return HTTP 403 with a structured JSON body. The error field is machine-readable and stable across API versions.
BORSAT_ACCESS_DENIED
Returned when the authenticated client does not hold a valid entitlement for the requested MIC + dataset combination.
"status": 403,
"error": "BORSAT_ACCESS_DENIED",
"message": "No active entitlement for MIC=XQAT, dataset=tick_data",
"details": {
"mic": "XQAT",
"dataset": "tick_data",
"access_right": "internal_use",
"contact": "support@borsat.ai for licensing"
},
"request_id": "3f8a1c2d-...",
"timestamp": "2025-05-01T09:14:32.001Z"
}
BORSAT_LICENSE_EXPIRED
The client's license for this exchange has lapsed. Data access is suspended until renewal.
BORSAT_REDISTRIBUTION_REQUIRED
The requested operation (e.g. bulk export for third-party delivery) requires a redistribution license.
📬 Licensing & Compliance Contact
For data licensing enquiries, redistribution rights, compliance documentation requests, or audit log exports, contact:
Data Licensing Team
data@borsat.ai
Compliance & Legal
legal@borsat.ai
Enterprise Sales
Contact form →