You are considering handing us your firm's numbers. This page describes what is actually built today, in plain terms, and ends with a list of what we do not claim yet. We would rather lose a deal than win one on a promise we cannot back.
Every table holding customer data is protected by Postgres row-level security. A row is readable only by the user who owns it or by members of the team it belongs to, and for billing and contract records also by our platform administrators. The policy is enforced by the database rather than by application code that could forget to check.
Team members hold an Owner, Team Admin, Editor or Viewer role, and a member can be scoped tighter than their role: access is granted module by module, read or write, so a bookkeeper reaches the books and nothing else. A member can be marked external, and owners and Team Admins can cap which parts a member's connected AI clients may reach at all. The assistant and any connected AI client run under the identity of the person who authorised them, so they inherit exactly that person's permissions and nothing more.
Sign-in is by Google, Microsoft, a passkey, or an emailed magic link. The app never asks for a password, so there is no password database to breach and no password policy to get wrong. Sessions do not last forever either: opening the app requires proving who you are again at the start of each working day, rather than a session living on in a cookie until somebody signs out.
New teams require every member to reach a second factor, an authenticator app (TOTP) or a passkey, before a session can be used. That covers the app, its APIs, approving an AI client such as Claude or ChatGPT, and the database itself: every table and the file storage return nothing to a session without the second factor except its own profile and team membership. A taken-over mailbox on its own therefore opens no team data. If the requirement cannot be checked, access is refused rather than let through. Owners and Team Admins can switch it off; a switch made in the app lands in the audit log. One deliberate exception, which we would rather write down than leave you to find: a session opened with a passkey satisfies the requirement, even though a passkey is a single factor. It cannot be phished, replayed or read out over the phone, which is the failure a team sets this flag against.
Invitations, role changes, removals, plan and integration changes are written by the application to a per-team audit log that members cannot edit or delete, readable by owners and Team Admins.
Edits to directory records, to positions with their cashflows, valuations and documents, to the books, to both loan registers and to letter drafts are written to a change protocol on the record itself, by database triggers rather than application code. A change made from the app, by the assistant, through a connected AI client or by a background job is recorded the same way, and none of those paths can skip it. It is readable by owners and Team Admins; the app shows it only for modules they are allowed to open.
For where this sits under the EU AI Act, our role, risk classification and the Article 50 marking, see AI and the EU AI Act.
When we extract figures from a report, the names of people in your directory are swapped for placeholders before the text reaches a model, and in capital-account tables so are the names of investing entities. The table mapping them back never leaves our side, and results are re-identified after the model has answered.
Our own model calls run on Vertex AI in an EU region, and document preprocessing runs on Modal in an EU region too. If a non-EU Vertex region is configured, the call raises an error instead of quietly sending the data somewhere else. Exceptions: teams that bring their own API key choose their provider's region themselves, and Jev, a model for routine questions such as what kind of document just came in, sends masked text to a provider in the US, but only for teams that turned it on themselves. Jev is off for every team by default (see sub-processors).
Amounts and dates go to the model unmasked, because the extraction is about them. Also not pseudonymized today: fund and portfolio-company names, names not yet in your directory, conversations with the assistant, the raw PDF sent for text conversion, and a few documents the model reads whole (sorting incoming mail, loan schedules, images in chat). Company and fund names also leave as web-search queries for enrichment. We would rather write that down than let you assume otherwise.
Two checks run. The first matches files byte for byte across the team, so a report that is both forwarded and uploaded resolves to one record. The second is a logical key of uploader, fund, period and report type: a second scan of a report you already uploaded is held for review rather than landing as portfolio events.
Every extraction is scored against itself, with no second model call. A report that falls below the bar is flagged for review, and both the quarterly-report cashflow path and the valuation path skip flagged reports. The queue shows why it was held; you can approve it, re-run the extraction, or archive its fund. The same holds for per-investor capital-account rows from that report: they are booked only once it is approved.
An assistant that can only read leaves you doing the typing. This one can create a position, record a cashflow, add a valuation or update a fund. The question worth asking is not whether it writes, but where it can write, what it waits for, and what it leaves behind. That is the rest of this section.
This is what separates it from an assistant pointed at a folder on your machine, which can rename, overwrite and delete anything it can reach and tell you afterwards. Ours reaches your portfolio through a fixed list of named operations against a database, each one scoped to what you can already see. There is no filesystem, no shell, and nothing outside that list is addressable.
Reading is free. In the in-app assistant, Manual is the default: recording a cashflow, adding a valuation or creating a position is only ever a proposal. It pauses, the interface shows exactly what would change, and nothing runs until you press confirm. Switch a chat to Auto and it makes changes in the app without stopping; turning Auto on asks you once, and every change is still in the change log. Anything that leaves the app, such as a Google Doc or a hosted report, asks in both modes, and Research mode only reads, whichever is set. It is also instructed never to guess a price, a date or a currency, and to ask in plain language when a field is missing. Claude and ChatGPT ask through their own tool-permission prompts, not ours. On our side, their writes are limited to your role and the areas you allowed, rate-limited, and recorded.
None of the tools given to Claude, ChatGPT or the in-app assistant can delete a position, a person, an entity or a bank account. Three narrow deletions exist: a hand-entered position event (not one that came from a report), a grant's vesting schedule, and a whole report, which takes its file and the events and valuations derived from it with it. In the app each one needs your confirmation, and each lands in the change history. Archiving applies only to bank accounts.
Positions carry their own event history, so a cashflow or valuation the assistant recorded appears as a dated entry alongside every other change, with the document it came from where there is one. The change log behind it marks whether a change came from the app, the assistant or a connected AI client, and owners and team admins can read it.
Claude and ChatGPT connect through a full authorization server with dynamic client registration, so there is no key to paste. For your own scripts you can create a personal access token yourself: it expires after at most a year, is shown once and stored only as a hash, carries your permissions and no more, and can be revoked on its own.
Authorization codes are bound to the client that requested them using PKCE with S256. The weaker plain method is rejected outright, and a code cannot be exchanged twice.
Access tokens last an hour, refresh tokens rotate on use, and only a hash of either is stored, never the token itself. You can revoke a connected assistant from your settings at any time.
A connected assistant queries through the same row-level policies as the person who authorised it, and the owner can cap which areas a member's connected assistants may reach.
Every response carries HTTP Strict Transport Security with a two-year max-age covering subdomains, so browsers refuse to talk to us unencrypted.
Responses set X-Frame-Options DENY and a frame-ancestors content security policy so the app cannot be embedded, plus nosniff, a strict referrer policy, and a permissions policy denying camera, microphone and geolocation.
Third-party credentials, such as a Slack token or a connected drive's refresh token, are encrypted with a key held in a key vault, with every decrypt recorded and a revocation switch that makes them unreadable.
The database, authentication and document storage run in Supabase's West EU region in Ireland, and the application's own server functions are pinned to Dublin, in the same AWS region, so a request is not answered from another continent on its way to an Irish database. Model calls and PDF preprocessing are separately pinned to EU regions, with the exceptions named above. Transactional email and forwarded reports pass through Postmark in the US.
Extracted cashflows and valuations reference the document they came from, and valuations also record the kind of source, so a number can be traced back to its document.
You can delete your account from settings without asking us. Your personal records and files are removed with it; records you created inside a team stay with that team. A team owner hands the team over first.
The owner can export the whole team's data from the settings: a ZIP with every table as CSV, the uploaded documents and a description of each file. Every member can also download their own personal data. Neither needs a request to us.
The database is backed up daily and each backup kept for 7 days. Your documents are also copied every night, encrypted, to a second data centre in Germany run by a different provider. When you delete a file, its copy is removed after 30 days, so an accidental deletion can be undone within that time.
The buckets holding investor reports, directory documents, bookkeeping documents, contracts and exports are private, with no public read access, and so are logos and the photos you add to people, properties and aircraft.
A team can connect its own SharePoint or Google Drive and receive a live mirror of uploaded fund reports and position documents: reports filed by fund, year and period, other documents by type, year and period. The documents your numbers are derived from then sit in storage you control, and stay there whatever happens to us. If the connection breaks it stops and says so in settings, rather than failing quietly.
Every third-party service that can touch customer data. Our DPA, in the version of 10 October 2026, names each of them, as a sub-processor, an independent recipient or a service under your own contract. The list changes as the product does; we notify customers of any new sub-processor at least 30 days in advance under section 8 of the DPA.
| Service | What it does |
|---|---|
| Supabase | Database, authentication and document storage |
| Hetzner Online GmbH | Encrypted backup copy of your documents (reports, receipts, contracts, directory documents and photos), nightly, in Falkenstein (Germany). Encrypted with our key, which Hetzner does not hold. Also the access logs of our database interface, kept 90 days, encrypted the same way |
| Vercel | Application hosting; Web Analytics and Speed Insights only with your consent; AI Gateway forwards Jev requests to TypeSafe, only for teams using Jev, keeping no content |
| Google Cloud Vertex AI | Model calls for extraction and the assistant, pinned to an EU region. For enriching directory and fund data, also Google Search with company and fund names, country and register number; search is not bound to the EU |
| Modal | Converting uploaded PDFs to text, pinned to an EU region |
| Postmark | Transactional email and inbound forwarded reports; processed in the US |
| Azure Key Vault | Key custody for stored third-party credentials |
| Slack, Microsoft Teams | Notifications, only if your team connects them |
| Google Drive, SharePoint | Document mirroring, only if your team connects it |
| Gmail, Microsoft 365 (Outlook) | Read-only mailbox connection, only for teams we enable it for on request; reads the folder or senders the team picks |
| Google Workspace (email sending), DATEV eG | Only if your team uses the DATEV hand-off: receipts as PDF with your company name, sent to your DATEV upload address |
| Anthropic, OpenAI, Google Gemini API | Only for teams that supply their own API key |
| TypeSafe AI, Inc. via Vercel AI Gateway | Only if your team turns Jev on, off by default: masked document text for routine questions such as a document's type, never the file; the provider keeps no content, only operational metadata such as time and usage; processed in the US |
| Flightradar24, aviationstack | Position and master data for the aircraft your team records. Queried by our servers with the registration; independent recipients |
| OpenStreetMap Foundation (Nominatim) | Coordinates for the properties your team records. Queried by our servers with the address, in the United Kingdom; independent recipient |
| GLEIF, Canada business registries (ISED) | Register lookups for entities in your directory. Queried by our servers with name and country; independent recipients |
| Google (News, website icons) | Press search for followed companies and funds, and website icons. Queried by our servers with names and web addresses; independent recipient |
| Wikimedia Commons, Openverse, Flickr | Photo search for aircraft by registration (Wikimedia Commons and Openverse, photos from Flickr) and for properties by street and city (Wikimedia Commons). Queried by our servers; independent recipients |
| OpenFreeMap | Map tiles. Your browser loads them directly, so the provider sees your IP address and the map area; independent recipient |
| Mapillary (Meta Platforms Ireland) | Street-level imagery for properties. Queried by our servers with coordinates near the address; independent recipient |
| sevDesk | Our invoicing and accounting. Your firm's billing details and the invoices we issue it; nothing from the product |
| Odoo S.A. | CRM for prospect, waitlist and account contact data. Your firm's name and your members' names and email addresses are mirrored from the app; no documents, portfolio records or figures are sent |
The product is in beta. These are the things people in this market reasonably ask about that we cannot honestly tick yet.
We will answer specifics, share our data processing agreement, and tell you plainly where a control does not exist yet. Security questions go straight to the founders.
Get in touch