BillionaireList holds two kinds of data: the public record about billionaires that we publish, and the account data of the people who use the service. This page explains how we handle both, how your account is protected and what Enterprise teams get for access control and compliance.
The data we publish
Profiles contain facts that are already public about people who are public figures because of their wealth: published net worth estimates, company roles, key business events and public philanthropy. Every figure carries its date and source. We do not publish home addresses, private contact details, family members who are not public figures or anything taken from private or leaked material. People on profiles can request corrections or restriction of personal details, as described on the corrections page.
The data we hold about you
For an account we store your email address, a hashed password, your plan and billing status, your saved lists and watchlists, your export and API usage, and technical logs needed to run and secure the service. We do not sell account data and we do not use advertising trackers. The privacy policy lists every category and how long we keep it.
Account security
Sign-up with email confirmation
Signing up takes two steps: your email and a password, then a code sent to that email. An account is active only after the code is entered, so no one can open an account in your name with an address they do not control.
Hashed passwords
Passwords are stored only as salted hashes produced by a modern, slow hashing algorithm. We never store or see your password in readable form, and support cannot look it up. If you forget it, you set a new one through a reset link sent to your email.
Sessions
Sessions are protected by secure, HTTP-only cookies and CSRF tokens. You can sign out of the current session at any time from your account.
API keys
API keys are shown once when created and stored only as hashes. You can create, name and revoke keys from your account. Each request is counted against your plan quota, and a revoked key stops working immediately.
Payments
Card payments are handled by a PCI compliant payment processor. Your card number is entered on the processor's secure payment page and never reaches our servers. We keep only what we need to manage your subscription, such as the plan, the billing period, the last four digits of the card and the payment status. Payments use bank authentication (3D Secure) where your card supports it.
Infrastructure and transport
The service is hosted by a hosting provider in the EU. All traffic to the site and the API is encrypted with HTTPS. Access to production systems is limited to the administrator of the service and protected by key-based authentication. Backups are encrypted and kept for a limited period.
Enterprise controls
Roles
Enterprise accounts include up to 15 seats with three roles. Admins manage seats, billing, API keys and settings. Analysts build lists, set alerts, export data and use the API. Viewers can read profiles, lists and dashboards without exporting.
Single sign-on
Enterprise teams can sign in through single sign-on with SAML, so access follows your own identity provider and is removed when someone leaves. Admins connect any SAML 2.0 identity provider under Security in the account, and can require single sign-on for everyone on the company email domain.
Audit log
The audit log records sign-ins, exports, API key changes, role changes and changes to saved lists, with the user, time and IP address. Admins can review it in the account and export it.
Data processing agreement
Enterprise admins open the data processing agreement in the account under Security, add the company details and accept it for the company, then print the signed copy or save it as PDF. If your legal team works from its own template, send it to [email protected] and we review it.
API uptime target
On Enterprise, the API has an uptime target of 99.9 percent per calendar month, excluding announced maintenance. We check the API every minute and Enterprise admins see the measured uptime of each month under Security in the account.
What we do not claim
We do not hold third party security certifications and we do not display badges for audits we have not passed. If your procurement process needs answers to a security questionnaire, send it to [email protected] and we answer it in writing.
Reporting a security issue
If you find a vulnerability, write to [email protected] with the details and steps to reproduce. Please do not access data that is not yours or disrupt the service while testing. We confirm receipt and keep you informed while we fix it.