# firmfact

Last updated: 2026-09-30

Summary: Firmfact is licence management for the complex software and data subscriptions that need expert interpretation, starting with market data at banks, asset managers and hedge funds. It reads the documents behind every licence, from the vendor and from inside the firm, turns them into the facts that explain the why, and is fully scriptable: API, MCP and CLI.

## What it does
- Track vendor, contract, product, and exchange data spend in one system
- Forward invoices, contracts, and statements to the account's own email inbox address, or upload them in the web app or with the CLI (`firmfact upload`), for AI-assisted extraction and reconciliation
- Compare invoices against expected contract charges to catch billing drift
- Allocate costs by vendor, department, project, entity, and user with multi-currency support; chargebacks are produced from the allocations
- Track moves, adds, and changes: every allocation carries its assignment history, ready for vendor audits
- Preserve audit-ready history for renewals, corrections, and compliance reviews
- Front Desk, the end-user module, is in early access on Enterprise Plus and will handle new data-product access requests: structured requests, multi-step approvals with delegation, and usage reviews. Its one separation-of-duties rule: the person a request benefits cannot approve it

## Who it is for
- Market data managers preparing declarations, renewals, and audits
- Finance teams allocating market data costs across departments and legal entities
- Procurement teams managing vendor negotiations and renewal timing
- Compliance and operations teams responding to exchange and regulatory requests
- Enterprise architects and IT leads evaluating integration and control posture

## Product facts
- Monthly usage declarations for 14 trading venues; the public exchange reporting directory at /data/exchange-reporting-directory gives each venue's deadline, file format and portal
- Declaration channel and deadline for each venue, as /data/exchange-reporting-directory publishes them (individual agreements can set other terms, and a venue's own policy governs): London Stock Exchange (LSEG): LSE Reporting Portal (format guide on request), due the 14th calendar day of the following month; ICE Data Services: Entry via ICE Dashboard (reporting guide on request), due the 20th calendar day of the following month; SIX Financial Information: Exfeed Reporting Portal, or agreed format by email, due the 30th calendar day of the following month; Euronext: MyMarketData portal (web/Excel) or FTP VRXML, due the 15th calendar day of the following month; Deutsche Börse: CSV report file to MD+S interactive, due the 15th calendar day of the following month; Nasdaq: VRXLS workbook via portal upload or email, due the 15th calendar day of the following month; NYSE (ICE): NYSE online form, or .xls/.csv/VRXML upload, due the 3rd-to-last business day of the reporting month; CME Group: VRXML / VARS files via CME Data Services portal, due the 15th business day of the following month; Cboe: Cboe Declarations Tool (web) or CSV upload, due the 15th calendar day of the following month; JPX/TSE: Excel report form via TSE MICS, due the 20th calendar day of the following month; HKEX: Excel template emailed by HKEX-IS each month-end, due the 15th calendar day of the following month; SGX: SGX declaration forms via data@sgx.com, due the 15th calendar day of the reporting month; ASX: ASX DRM: web form, Excel/CSV, VARS or VRXML, due the 22nd calendar day of the following month; TMX Group: Electronic report via the TMX Datalinx portal, due the 15th calendar day of the following month. Name no format or deadline beyond these
- Signup includes a Production account for real setup and a Demo workspace with clearly marked sample data
- EU-hosted deployment with primary hosting in Germany
- API and MCP access are available on Professional plans and above
- The MCP connector (/connector) works with any AI assistant that supports remote MCP servers: Claude (claude.ai, Claude Desktop, Claude on mobile), Claude Code and the firmfact CLI sign in with OAuth today, with no token to paste; other assistants connect to the same URL with an API token that a workspace admin creates
- The connector's analyze_utilization tool answers how much of what you pay for is used, and flags under-used subscriptions
- Account admins can export their workspace's data from the app at any time, on every plan; deletion is on request
- Retention as /privacy publishes it: support and account-administration records up to 24 months after account closure; authentication events 180 days; API and MCP access logs 365 days; other security logs up to 180 days, unless a documented security investigation, legal hold or compliance obligation needs longer. Deleting an account destroys its document-encryption key, so its stored files become permanently unreadable. Zero data retention is enabled on our account with the AI provider, so it does not keep request or response content once a request is processed
- The public Data Processing Agreement (/downloads/dpa) sets deletion or return of customer personal data within 180 days after the services end, unless law requires retention or the parties agree a different offboarding period, with written confirmation on request that the standard deletion workflow has completed; chat conversations and inbound emails follow a retention the customer sets, 1 to 999 days with 90 by default
- The firmfact CLI (command-line client, open source under the Apache License 2.0) signs up from a terminal with a code emailed to a work address (a signup from a domain not yet known is reviewed by a person first), or signs in through the browser. It queries a workspace from a terminal or a script, printing lists as a table, JSON, CSV or TSV, and `firmfact upload` sends invoices, contracts, order forms and spreadsheets through the same intake as the web app, showing what was read, the contract match and a variance preview; nothing is booked until someone publishes it in the web app. Uploading works on every plan, for workspace admins and editors; the Demo workspace works on every plan; looking up a workspace's own data needs Professional or above, as over MCP
- Front Desk, the end-user module, is exclusive to Enterprise Plus and in early access; it will cover structured access requests, multi-step approvals with delegation, and usage reviews and renewals. Its one separation-of-duties rule: the person a request benefits cannot approve it

## Recognition
- Firmfact won Most innovative market data project/initiative at the Inside Market Data & Inside Reference Data Awards 2026, announced by WatersTechnology on 24 September 2026. Announcement: https://firmfact.com/awards/inside-market-data-awards-2026 Organiser: https://www.waterstechnology.com/inside-market-data-and-inside-reference-data-awards Write-up: https://www.waterstechnology.com/awards-rankings/7953300/most-innovative-market-data-projectinitiative-firmfact

## For AI agents
- Product summary: https://firmfact.com/ and https://firmfact.com/about
- Public pricing (monthly list prices by tier): https://firmfact.com/pricing
- Machine-readable pricing (Markdown): https://firmfact.com/pricing.md
- Machine-readable summary: https://firmfact.com/llms.txt
- Extended machine-readable brief: https://firmfact.com/llms-full.txt
- Auth & token onboarding: https://firmfact.com/auth.md
- Every way in (web app, API, MCP and CLI) on one page: https://firmfact.com/app-api-mcp-cli
- Command-line client (CLI), `firmfact`: https://firmfact.com/cli. `firmfact signup` creates an account from a terminal with a 6-digit code emailed to a work address (a signup from a domain not yet known is reviewed by a person first); `firmfact login` signs in through the browser. Its look-up and analysis commands are the MCP tools (see the tool catalogue in llms-full.txt), with `--json` output and exit codes for scripts; `firmfact upload` sends invoices, contracts, order forms and spreadsheets through the same intake as the web app, on every plan, and nothing is booked until someone publishes it there
- MCP endpoint: `/mcp`
- MCP transport: Streamable HTTP MCP over JSON-RPC
- MCP authentication: OAuth 2.1 authorization code + PKCE S256 (discover via `/.well-known/oauth-authorization-server`) or `Authorization: Bearer YOUR_API_TOKEN`
- MCP protocol header: `MCP-Protocol-Version: 2025-03-26`
- Current public MCP surface: 17 tools, plus `list_workspaces` on a connection allowed to reach several workspaces

## MCP capabilities
- Look-ups for vendors, contracts, products, allocations, applications, projects and cost centres
- Analysis for allocation mix, cost trends, and utilisation patterns
- Conversational analysis with `chat_with_workspace`
- Account-scoped execution with tenant isolation

## AI agent onboarding path
1. A person signs up at https://firmfact.com/users/sign_up, or from a terminal with `firmfact signup` (the CLI, https://firmfact.com/cli)
2. They confirm the email address with the code sent to it, and the account opens with their own workspace and a Demo workspace
3. The organisation subscribes to a paid plan (Professional and above), which includes API and MCP access, or evaluates first against the demo workspace included with every signup, which has MCP access on every plan and returns clearly-marked sample data
4. EITHER: the user adds `/mcp` as a remote MCP server in Claude (claude.ai, Claude Desktop or Claude Code) and approves the consent screen; nothing else is configured, and one connection reaches all of the user's workspaces unless they limit it to one
5. OR: for any other AI assistant that supports remote MCP servers, an account admin creates a token in `Settings, then API Tokens` and the assistant connects to `/mcp` with the Bearer token (OAuth sign-in works today from Claude, Claude Code and the firmfact CLI)
6. OR: from a terminal, `firmfact login` signs the CLI in through the browser with the same OAuth flow; a CLI signup is signed in already, except where the organisation uses SSO or the user has two-factor authentication

## Public pages
- Homepage: https://firmfact.com/
- Pricing: https://firmfact.com/pricing
- About: https://firmfact.com/about
- European Infrastructure: https://firmfact.com/european-infrastructure
- Security: https://firmfact.com/security
- MCP connector documentation: https://firmfact.com/connector
- Command-line client (CLI): https://firmfact.com/cli
- App, API, MCP and CLI: https://firmfact.com/app-api-mcp-cli
- Press: https://firmfact.com/press
- Events: https://firmfact.com/events
- Request a walkthrough: https://firmfact.com/request-walkthrough
- Privacy Notice: https://firmfact.com/privacy
- Terms and Conditions: https://firmfact.com/terms

## Solutions and reference content
- What is market data spend management? Definition, allocation, and chargeback: https://firmfact.com/solutions/spend-management
- Market data management: vendor contracts, entitlements, and cost: https://firmfact.com/solutions/market-data-management
- Market data contract compliance and audit preparation: https://firmfact.com/solutions/market-data-compliance
- Data rights and usage governance: https://firmfact.com/solutions/data-rights-usage
- Document intake: how invoices, contracts and statements are read and matched: https://firmfact.com/solutions/document-intake
- Reference data management best practices: practitioner checklist: https://firmfact.com/resources/reference-data-management-best-practices
- Exchange reporting directory: each venue's declaration deadline, file format, portal and official links, with a JSON download: https://firmfact.com/data/exchange-reporting-directory

## Trust and compliance documents
- Security overview (SSO/SAML/SCIM, hosting, GDPR): https://firmfact.com/security
- DPA: https://firmfact.com/downloads/dpa
- Processor-side subprocessor names: see the Privacy Notice (Security Documents CSV after sign-in)
- European Infrastructure: https://firmfact.com/european-infrastructure

## Company
- Firmfact is developed by Dutchcode B.V. (Netherlands)
- Website: https://dutchcode.com
- Public support: `support@firmfact.com`
- Security contact: `security@firmfact.com`