You are considering handing us your firm's numbers. This page describes what is actually built today, in plain terms, and ends with a list of what we do not claim yet. We would rather lose a deal than win one on a promise we cannot back.
Every table holding customer data is protected by Postgres row-level security. A row is readable only by the user who owns it or by members of the team it belongs to, and the policy is enforced by the database rather than by application code that could forget to check.
Team members hold an owner, manager, editor or viewer role. The assistant and any connected AI client run under the identity of the person who authorised them, so they inherit exactly that person's permissions and nothing more.
Sign-in is by Google, Microsoft, or an emailed magic link. We never store a password, so there is no password database to breach and no password policy to get wrong.
A team can require TOTP two-factor for everyone in it. Once switched on, every session for every member of that team has to reach the second factor before it can be used.
Invitations, role changes, removals, plan and integration changes are written to a per-team audit log that members cannot edit or delete, readable by managers and owners.
Names of people and entities are swapped for placeholders before a document or question reaches a model, and the table mapping them back never leaves our side. Results are re-identified after the model has answered.
Model calls are pinned to an EU region, and document preprocessing runs in an EU region too. If a non-EU region is configured, the call raises an error instead of quietly sending the data somewhere else.
Amounts and dates go to the model unmasked, because the extraction is about them. Fund and portfolio-company names, and the raw PDF sent for text conversion, are also not pseudonymized today. We would rather write that down than let you assume otherwise.
Two checks run before anything commits. The first matches files byte for byte, so a report that arrives both by forwarding and through a connected mailbox resolves to one record. The second is a logical key of owner, fund, period and report type, so two different scans of the same quarterly report cannot both land as portfolio events.
Every extraction is scored against itself, with no second model call. A report that falls below the bar is flagged for review, and both the cashflow path and the valuation path skip flagged reports entirely. Its numbers cannot reach your portfolio until a person approves it, and the queue shows why it was held. You can approve it, re-run the extraction, or archive it.
An assistant that can only read leaves you doing the typing. This one can create a position, record a cashflow, add a valuation or update a fund. The question worth asking is not whether it writes, but where it can write, what it waits for, and what it leaves behind. That is the rest of this section.
This is what separates it from an assistant pointed at a folder on your machine, which can rename, overwrite and delete anything it can reach and tell you afterwards. Ours reaches your portfolio through a fixed list of named operations against a database, each one scoped to what you can already see. There is no filesystem, no shell, and nothing outside that list is addressable.
Reading is free. Recording a cashflow, adding a valuation or creating a position is only ever a proposal: the assistant pauses, the interface shows exactly what would change, and nothing runs until you press confirm. The assistant is also instructed never to guess a price, a date or a currency, and to ask in plain language when a field is missing.
Across every tool we expose to Claude, ChatGPT and the in-app assistant, there is no delete operation of any kind. The verbs are list, get, find, create, record, add and update. It cannot remove a position, a cashflow, a valuation, a report or a document, because the capability does not exist in the interface it is given.
Positions carry their own event history, so a cashflow or valuation the assistant recorded appears as a dated entry alongside every other change, with the document it came from where there is one. You can see what happened, when, and on what basis, rather than having to trust that it went well.
Assistants connect through a full authorization server with dynamic client registration. There is no long-lived API key to copy into a config file and forget about.
Authorization codes are bound to the client that requested them using PKCE with S256. The weaker plain method is rejected outright, and a code cannot be exchanged twice.
Access tokens last an hour, refresh tokens rotate on use, and only a hash of each token is stored, never the token itself. You can revoke a connected assistant from your settings at any time.
A connected assistant queries through the same row-level policies as the person who authorised it, and can be limited to specific features.
Every response carries HTTP Strict Transport Security with a two-year max-age covering subdomains, so browsers refuse to talk to us unencrypted.
Responses set X-Frame-Options DENY and a frame-ancestors content security policy so the app cannot be embedded, plus nosniff, a strict referrer policy, and a permissions policy denying camera, microphone and geolocation.
Third-party credentials, such as a Slack token or a connected drive's refresh token, are encrypted with a key held in a key vault, with every decrypt recorded and a revocation switch that makes them unreadable.
The database, authentication and document storage run in Supabase's West EU region in Ireland. Model calls and PDF preprocessing are separately pinned to EU regions, as described above.
Extracted values reference the document they came from and the kind of source it was, so any number in the system can be traced to the page it was read from.
You can delete your account from settings without asking us. Records owned by the account are removed with it.
The buckets holding investor reports, directory documents and bookkeeping documents are private, with no public read access.
A team can connect its own SharePoint or Google Drive and receive a live mirror of every uploaded PDF, filed by fund, year and period. The documents your numbers are derived from then sit in storage you control, and stay there whatever happens to us. If the connection breaks it stops and says so in settings, rather than failing quietly.
Every third-party service that can touch customer data. Ask us for the current list before signing anything, since this changes as the product does.
| Service | What it does |
|---|---|
| Supabase | Database, authentication and document storage |
| Vercel | Application hosting |
| Google Cloud Vertex AI | Model calls for extraction and the assistant, pinned to an EU region |
| Modal | Converting uploaded PDFs to text, pinned to an EU region |
| Inngest | Background jobs such as document extraction |
| Postmark | Transactional email and inbound forwarded reports |
| Azure Key Vault | Key custody for stored third-party credentials |
| Slack, Microsoft Teams | Notifications, only if your team connects them |
| Google Drive, SharePoint | Document mirroring, only if your team connects it |
| Anthropic, OpenAI | Only for teams that supply their own API key |
The product is in closed beta. These are the things people in this market reasonably ask about that we cannot honestly tick yet.
We will answer specifics, share our data processing agreement, and tell you plainly where a control does not exist yet. Security questions reach the two of us directly.
Get in touch