SEC Form 4 Insider Cluster Scanner

Finds groups of corporate insiders buying their own company's stock at the same time — and tells you whether the buying was pre-scheduled or a live decision. It reads SEC Form 4 filings straight from EDGAR, groups open-market purchases by issuer inside a rolling window, and returns each cluster with the officers' titles, the dollars, the share bought under a Rule 10b5-1 plan, and a link to every filing behind it. Built for retail and independent investors, newsletter writers, and quant hobbyists who want insider-buying signal without paying for a terminal.

What a cluster is

A cluster is an issuer where several different insiders — distinct people, not one person filing twice — each made an open-market purchase of the company's stock inside the same window. One director buying is routine. A chief operating officer, a co-CFO, a chief strategy officer and four directors all buying in the same week is an event. You set the thresholds: how many insiders, how many dollars in aggregate, how many days wide the window is. The Actor returns the clusters that clear them, largest first.

A real result

This is an actual record the Actor produced from live EDGAR data. Seven insiders at Star Bulk Carriers bought $6.75 million of stock on a single day, and none of it was pre-scheduled:

{
  "type": "cluster",
  "ticker": "SBLK",
  "issuerName": "Star Bulk Carriers Corp.",
  "insiderCount": 7,
  "txCount": 8,
  "totalDollar": 6750876.0,
  "firstBuy": "2026-09-15",
  "lastBuy": "2026-09-15",
  "plan10b51DollarPct": 0.0,
  "officerTitles": ["Chief Operating Officer", "Chief Strategy Officer", "Head of Operations", "co CFO"],
  "hasTenPercentOwner": false,
  "insiders": [
    {
      "name": "Pappas Alexandros",
      "role": "Head of Operations",
      "shares": 74400.0,
      "dollar": 2103288.0,
      "is10b51": false,
      "filingUrls": ["https://www.sec.gov/Archives/edgar/data/2107497/000210749726000002/"]
    },
    { "name": "Zagari Raffaele", "role": "Director", "dollar": 1696200.0, "is10b51": false, "...": "..." },
    { "name": "Spyrou Symeon", "role": "co CFO", "dollar": 424050.0, "is10b51": false, "...": "..." },
    { "name": "Reskos Nikolaos", "role": "Chief Operating Officer", "dollar": 282700.0, "is10b51": false, "...": "..." }
  ],
  "windowDays": 21,
  "scanEndDate": "2026-09-18"
}

This example was produced with a 21-day window and a $50,000 aggregate threshold — wider than the defaults of 14 days and $250,000 in the Input table below — which is why the record shows "windowDays": 21. The same cluster clears the defaults comfortably: seven insiders and $6.75 million inside a single day.

Every insider carries the EDGAR URL of the filing the numbers came from. Nothing in a record is inferred; it is read from the filing XML.

What makes it different from the incumbents

Most Form 4 scrapers read the summary table. This one parses the filing XML, so it can output four things they cannot:

Field	Why it matters
plan10b51DollarPct	Share of the cluster's dollars bought under a Rule 10b5-1 plan. A pre-scheduled purchase carries no signal about what the insider knows today. A cluster that is 90% 10b5-1 is noise wearing a signal's clothes. Read from the form-level affirmative defense flag and per-transaction footnote references.
officerTitles	CFO buying is not the same event as a non-employee director buying.
hasTenPercentOwner	A 10% holder topping up is a different trade from an officer's first open-market purchase.
insiders[].filings / filingUrls	Every claim links back to the EDGAR document it came from.

Footnote text is parsed, not skipped — that is where the 10b5-1 disclosure usually lives when the form-level flag is absent.

Output

One dataset, two record shapes, both in the Clusters and Transactions table views:

• type: "cluster" — the product. One record per issuer that clears your thresholds, ranked by total dollars, with the fields shown above.
• type: "transaction" — every individual purchase parsed in the run, with the insider's name, title, ten-percent-owner status, date, shares, price, dollar value and 10b5-1 flag. On by default (includeTransactions), so a run always returns rows even in a quiet week; turn it off if you only want clusters.

Input

Field	Default	What it does
secContactEmail	the maintainer's address	The SEC requires every automated request to identify its sender; this goes in the User-Agent sent to sec.gov and nowhere else. Replace it with your own address — the SEC identifies the requester by it.
lookbackDays	7	How many days of EDGAR daily indices to scan. Seven always spans several filing days, including holiday weekends.
windowDays	14	Insiders must all have bought inside this many days to count as one cluster.
minInsiders	2	Distinct insiders required. Raise to 3 to filter harder.
minAggregateUsd	250,000	Total open-market dollars across the cluster.
maxFilings	300	Cap on filings parsed per run. Bounds both runtime and cost. Raise it for a full week's coverage.
includeTransactions	true	Also emit every parsed transaction.
endDate	today	Scan a past window by setting the last day (YYYY-MM-DD).

Requests to EDGAR are paced at about 7.5 per second, under the SEC's published limit. That pacing is not configurable, by design.

Pricing

You pay per event, so the bill tracks what the run actually did:

Event	Price	Charged when
Actor start	$0.01	once per run
Form 4 filing parsed	$0.0004	per filing actually downloaded and parsed. Cached, missing or errored filings are not charged.
Insider cluster detected	$0.02	per cluster returned — the output you came for

A realistic full-week run. During testing, a six-day window with the threshold lowered to $50,000 parsed 1,400 filings and found 15 clusters: $0.01 + 1,400 × $0.0004 + 15 × $0.02 = $0.87. At the shipped $250,000 default, 7 of those 15 clusters qualify and the same run costs $0.71. Run it weekly and it is about $3 to $3.50 a month. A default run (300 filings) costs well under $0.20. Apify platform usage is billed separately and is small: this is a plain Python container with no browser.

Why the margin is real

• No headless browser. EDGAR serves static .idx and .xml over plain HTTP. A competitor running Playwright pays for a browser image and the RAM to match, for identical bytes.
• No residential proxy. EDGAR does not block datacenter IPs. It asks for an identifying User-Agent and a request rate below 10/s, and it means it. This Actor sends a real contact address and holds ~7.5 req/s.
• No paid data source. Every byte is free from sec.gov.

The compute bill is a plain Python container and the data bill is zero. That is why the per-record price can be what it is.

What this does not do

• It is not investment advice. A cluster is a fact about filings, not a recommendation. Insiders buy for many reasons, and a filed purchase is public information the market already has.
• Buying only. It counts open-market purchases (Form 4 transaction code P, non-derivative). It does not report sales, option exercises, grants, or gifts, and it does not compute net insider activity.
• Form 4 only. Form 3 (initial holdings) and Form 5 (annual) are not read.
• Not real time. It works from EDGAR's daily index, so a filing appears in the day's index, not the moment it is accepted. Weekends and federal holidays have no filings.
• One issuer, one window. It does not track an insider across companies or build a history; run it with endDate for past windows.

Using it

Set your secContactEmail, keep the other defaults for a first run, and start it. Results are in the default dataset in the Clusters view; download as JSON or CSV, or call it from the API and read the dataset in code. Schedule it weekly to get a standing list of the companies whose officers put their own money in that week — and how much of it was decided rather than pre-programmed.