You are considering handing us your firm's numbers. This page describes what is actually built today, in plain terms, and ends with a list of what we do not claim yet. We would rather lose a deal than win one on a promise we cannot back.
Every table holding customer data is protected by Postgres row-level security. A row is readable only by the user who owns it or by members of the team it belongs to, and the policy is enforced by the database rather than by application code that could forget to check.
Team members hold an Owner, Team Admin, Editor or Viewer role, and a member can be scoped tighter than their role: access is granted module by module, read or write, so a bookkeeper reaches the books and nothing else. A member can be marked external, and an owner can cap which parts a member's connected AI clients may reach at all. The assistant and any connected AI client run under the identity of the person who authorised them, so they inherit exactly that person's permissions and nothing more.
Sign-in is by Google, Microsoft, a passkey, or an emailed magic link. We never store a password, so there is no password database to breach and no password policy to get wrong. Sessions do not last forever either: one has to prove who it belongs to again at the start of each working day, rather than living on in a cookie until somebody signs out.
A team can require TOTP two-factor for everyone in it. Once switched on, every session for every member of that team has to reach the second factor before it can be used. One deliberate exception, which we would rather write down than leave you to find: a session opened with a passkey satisfies the requirement, even though a passkey is a single factor. It cannot be phished, replayed or read out over the phone, which is the failure a team sets this flag against.
Invitations, role changes, removals, plan and integration changes are written to a per-team audit log that members cannot edit or delete, readable by owners and Team Admins.
Edits to directory records and to both loan registers are written to a change protocol on the record itself, by database triggers rather than by application code. A change made in the app, by the assistant, through a connected AI client or by a background job is therefore recorded the same way, and none of those routes can skip it. The protocol is readable by owners and Team Admins, and only for the modules they are allowed to open.
For where this sits under the EU AI Act, our role, risk classification and the Article 50 marking, see AI and the EU AI Act.
Names of people and entities are swapped for placeholders before a document or question reaches a model, and the table mapping them back never leaves our side. Results are re-identified after the model has answered.
Model calls are pinned to an EU region, and document preprocessing runs in an EU region too. If a non-EU region is configured, the call raises an error instead of quietly sending the data somewhere else.
Amounts and dates go to the model unmasked, because the extraction is about them. Fund and portfolio-company names, and the raw PDF sent for text conversion, are also not pseudonymized today. We would rather write that down than let you assume otherwise.
Two checks run before anything commits. The first matches files byte for byte, so a report that arrives both by forwarding and through a connected mailbox resolves to one record. The second is a logical key of owner, fund, period and report type, so two different scans of the same quarterly report cannot both land as portfolio events.
Every extraction is scored against itself, with no second model call. A report that falls below the bar is flagged for review, and both the cashflow path and the valuation path skip flagged reports entirely. Its numbers cannot reach your portfolio until a person approves it, and the queue shows why it was held. You can approve it, re-run the extraction, or archive it.
An assistant that can only read leaves you doing the typing. This one can create a position, record a cashflow, add a valuation or update a fund. The question worth asking is not whether it writes, but where it can write, what it waits for, and what it leaves behind. That is the rest of this section.
This is what separates it from an assistant pointed at a folder on your machine, which can rename, overwrite and delete anything it can reach and tell you afterwards. Ours reaches your portfolio through a fixed list of named operations against a database, each one scoped to what you can already see. There is no filesystem, no shell, and nothing outside that list is addressable.
Reading is free. Recording a cashflow, adding a valuation or creating a position is only ever a proposal: the assistant pauses, the interface shows exactly what would change, and nothing runs until you press confirm. The assistant is also instructed never to guess a price, a date or a currency, and to ask in plain language when a field is missing.
Across every tool we expose to Claude, ChatGPT and the in-app assistant, there is no delete operation of any kind. The verbs are list, get, find, create, record, add, update, set, code and import, and archive, which reaches a bank account a team has stopped using and nothing else. It cannot remove a position, a cashflow, a valuation, a report or a document, because the capability does not exist in the interface it is given.
Positions carry their own event history, so a cashflow or valuation the assistant recorded appears as a dated entry alongside every other change, with the document it came from where there is one. You can see what happened, when, and on what basis, rather than having to trust that it went well.
Assistants connect through a full authorization server with dynamic client registration. There is no long-lived API key to copy into a config file and forget about.
Authorization codes are bound to the client that requested them using PKCE with S256. The weaker plain method is rejected outright, and a code cannot be exchanged twice.
Access tokens last an hour, refresh tokens rotate on use, and only a hash of each token is stored, never the token itself. You can revoke a connected assistant from your settings at any time.
A connected assistant queries through the same row-level policies as the person who authorised it, and can be limited to specific features.
Every response carries HTTP Strict Transport Security with a two-year max-age covering subdomains, so browsers refuse to talk to us unencrypted.
Responses set X-Frame-Options DENY and a frame-ancestors content security policy so the app cannot be embedded, plus nosniff, a strict referrer policy, and a permissions policy denying camera, microphone and geolocation.
Third-party credentials, such as a Slack token or a connected drive's refresh token, are encrypted with a key held in a key vault, with every decrypt recorded and a revocation switch that makes them unreadable.
The database, authentication and document storage run in Supabase's West EU region in Ireland, and the application's own server functions are pinned to Dublin, in the same AWS region, so a request is not answered from another continent on its way to an Irish database. Model calls and PDF preprocessing are separately pinned to EU regions, as described above.
Extracted values reference the document they came from and the kind of source it was, so any number in the system can be traced to the page it was read from.
You can delete your account from settings without asking us. Records owned by the account are removed with it.
The buckets holding investor reports, directory documents and bookkeeping documents are private, with no public read access.
A team can connect its own SharePoint or Google Drive and receive a live mirror of every uploaded PDF, filed by fund, year and period. The documents your numbers are derived from then sit in storage you control, and stay there whatever happens to us. If the connection breaks it stops and says so in settings, rather than failing quietly.
Every third-party service that can touch customer data. Ask us for the current list before signing anything, since this changes as the product does.
| Service | What it does |
|---|---|
| Supabase | Database, authentication and document storage |
| Vercel | Application hosting |
| Google Cloud Vertex AI | Model calls for extraction and the assistant, pinned to an EU region |
| Modal | Converting uploaded PDFs to text, pinned to an EU region |
| Postmark | Transactional email and inbound forwarded reports |
| Azure Key Vault | Key custody for stored third-party credentials |
| Slack, Microsoft Teams | Notifications, only if your team connects them |
| Google Drive, SharePoint | Document mirroring, only if your team connects it |
| Anthropic, OpenAI | Only for teams that supply their own API key |
| sevDesk | Our invoicing and accounting. Your firm's billing details and the invoices we issue it; nothing from the product |
| Odoo S.A. | CRM for prospect, waitlist and account contact data. Your firm's name and your members' names and email addresses are mirrored from the app; no documents, portfolio records or figures are sent |
The product is in beta. These are the things people in this market reasonably ask about that we cannot honestly tick yet.
We will answer specifics, share our data processing agreement, and tell you plainly where a control does not exist yet. Security questions reach the two of us directly.
Get in touch