SECURITY AND DATA
Built for a firm an examiner will visit.
What follows is what the product does, not a badge: where the firm's records sit, who can read them, and what is written down and not rewritten.
The firm's workspace is its own.
- Each firm's records, members and branding sit in a workspace of their own. No firm's records are pooled with another's.
- A file added to a plan is stored against that workspace.
- The product is served over the firm's own domain, on certificates issued for it.
- A credential or a key is held in an encrypted vault and referred to by name, never by value.
Roles decide who sees which plan, and the server enforces it.
- Roles are a grid of capability by role, enforced on the server, not by hiding a screen.
- Each person signs in with a passkey, a second factor or a one-time link, and the firm can require a second factor or a passkey of each member from a set day.
- A sponsor can be given a login-walled view of their own plan and nothing else.
A ledger, not a log.
- Each change to a record is written down with who made it, and the entry is not edited afterwards.
- The record says what was done, by whom, including which assistant and on whose authority.
- Releases of the product are immutable and dated, and any one of them can be rolled back.
A weekly backup, and a version to roll back to.
- A weekly backup is kept, and a table can be restored from it.
- The product's releases carry full history and roll back in one step.
The assistant's permissions are checked before it acts.
- Each action the assistant takes is checked against the firm's rules before it runs.
- It sends no mail. It writes drafts into a person's own Outlook and reads the thread.
- It does not edit a plan document.
What the public page can reach.
- This site is a published page. The demo form is a write-only intake: it can add a row and read nothing.
- A page behind a login is not published as HTML and is not listed.
What we do not claim.
Said plainly rather than implied by a badge.
- No SOC 2 report. We do not hold one. If your diligence requires it, say so in the demo and we will tell you where that stands.
- No ISO 27001 certificate. We do not hold one.
- No penetration-test letter to hand out today.
- No claim about where in the world the data is stored, beyond the workspace being the firm's own. Ask and we will answer precisely.
- No read-access record. Changes are written down; a per-read record is not kept, and we will not imply it is.
Questions a CCO asks.
Is our data used to train a model?
No.
Can we get our book out?
Yes. The firm's own tables, with the documents.
Who at your end can see our plans?
Only a person the firm admits to its workspace, under a role the firm sets.
What happens to a document when an obligation is waived?
It stays on the plan, with the reason the obligation was waived beside it.