Bring your own data: the CSV contract and the provider allowlist

A research workspace is only as trustworthy as the data going into it, and one of the least glamorous but most consequential design decisions in Quant Compose is how strictly it treats the data a researcher brings in. It refuses malformed input rather than guessing at what was meant, and it refuses to fetch from a provider it has not explicitly allowlisted, rather than quietly trying anywhere a URL might resolve. Both refusals are deliberate.

The CSV contract

Uploading price data means uploading a CSV file — there is no XLSX or JSON path for bringing in prices, which keeps the format simple enough to be checked reliably. The required columns, matched case-insensitively, are date, ticker, open, high, low, close and volume; an adjusted-close column is optional and defaults to the close price if it is absent. If any required column is missing, the upload is rejected outright with an HTTP 400 response naming exactly which columns were not found, rather than proceeding with whatever columns happened to be present.

Rows the workspace cannot parse — an unparseable date, a missing ticker, a non-numeric close — are dropped from the upload, and the number dropped is reported back rather than silently absorbed. Tickers are upper-cased and de-duplicated per ticker-and-date pair, so the same security appearing twice for the same day under slightly different casing does not silently double-count. Once the file is processed, the workspace reconciles it against the project’s already-declared universe and benchmark: if the configured benchmark ticker is not actually present in the uploaded file, or if the average number of observations per security falls under 260 — roughly a year of daily data — a warning is surfaced rather than allowing a thin dataset to pass as if it were adequate.

Providers, and what “available” actually means

Beyond a manual CSV upload, the workspace can pull prices, returns and other series from a defined set of providers, each with its own status. A synthetic reference dataset — deterministic, seeded, requiring no network call — is available for exploring the workspace’s mechanics without depending on external data, and it is never treated as a basis for a claim about a real security’s behaviour. Yahoo Finance is available and free, requires internet access, and carries its own caveat about restatement risk after corporate actions. The Ken French Data Library is available for factor data with no credential required beyond internet access. FRED, for macro series, and Alpha Vantage and Polygon, for prices and fundamentals, are conditional on the deployment holding a valid API key, with Alpha Vantage additionally rate-limited to five calls a minute. A custom REST endpoint can be configured for a proprietary data source, and LSEG and Bloomberg are listed as enterprise adapters that depend on licensed access the workspace does not itself supply — until that access is in place, the workspace states that the source is unavailable rather than connecting to it on an assumption.

The one behaviour that never happens, regardless of which provider is configured or how a request to it fails, is a silent fallback to synthetic data in place of the real data that was actually requested. A failed real-data fetch stops the workflow and reports why; it does not quietly substitute a plausible-looking synthetic series in its place. Plausible fake data is worse than no data at all, because no data stops a researcher from proceeding on a false premise, and plausible data does not.

The egress allowlist, and why it exists

Every outbound request the workspace makes to fetch external data is checked against an explicit allowlist of approved hosts. HTTPS is enforced unless a host has been explicitly opted out, every redirect the request follows is re-checked against the same allowlist rather than trusted once the first hop clears it, and private, loopback and link-local addresses are refused outright as an explicit defence against a request being redirected somewhere it should never reach. Requests are bounded by a twenty-second timeout, a maximum response size of thirty-two megabytes, and a maximum of three redirect hops, and any credentials used to authenticate with a provider are redacted before anything about the request is logged.

None of this is visible to a researcher in the ordinary course of using the workspace — it operates quietly, the way a seatbelt does, mattering only in the situation it exists to prevent. It reflects the same underlying principle as the CSV contract: a research tool that is careless about where its data comes from, or how a fetch failure is handled, produces results whose foundation cannot actually be trusted, however sound the statistics built on top of that foundation later turn out to be.

What this means in practice for a researcher

For most day-to-day use, the practical upshot is simple: bring a CSV with the required columns, correctly formatted dates and enough history per security, or use one of the available connectors within its stated scope, and the workspace does the rest without further attention required. The friction shows up specifically when something is wrong — a missing column, a benchmark absent from an uploaded file, a provider that needs a credential that has not been configured — and in every one of those cases, the workspace’s response is to say plainly what is missing, rather than to proceed on an assumption and produce a result whose foundation the researcher never had the chance to check.