- Is the data encrypted?
- In transit, everywhere: between your browser and the platform, and between the platform and its database, its document store and every service it calls. At rest, the database and the document store are encrypted by the providers that run them. Bank connection credentials are encrypted a second time inside the application itself, with a key the providers never hold.
- Where does the data live, and who runs the infrastructure?
- Each family has its own deployment and its own database, in the United States, on managed infrastructure. The providers that touch a family’s data are listed by name in the security program, with what each one holds. We will share the list before you ask for it.
- What happens if something is lost?
- The database keeps a continuous seven-day history, so a mistake can be undone to the minute, and restores are rehearsed. The targets are written down and a family can hold us to them: at most one day of data at risk, and the platform back within four business hours.
- Who can see what a family holds?
- Only the people the family office has signed in through its own identity provider, and only what their role allows. Every time a stored document is opened or downloaded, the platform records who opened it, in a record that is sealed and verified every day.
- Does the AI see sensitive documents?
- Yes. To read a lease or a K-1, the text of the document goes to the AI provider through one controlled gateway, and what comes back is a proposal for a person to approve. The provider’s published position is that it does not keep or train on that content. Contractual zero-retention terms with the provider are in progress and not yet signed.
- Can the AI change a record or move money?
- No. It proposes. A person approves, and the approval is dated and logged. Anything that spends money, changes a record, files, elects or contacts someone outside the office asks first.
- Who owns the data, and can a family leave?
- The family. A complete export, the records and the documents, can be produced at any time, and the export itself is logged. When a relationship ends, the export is delivered first, and then the deployment and its backups are deleted on a stated schedule.
- How long is data kept after it is deleted?
- A deleted document and its record are removed for good on the thirty-first day, by a daily job that writes to the audit record. Backups expire on their own schedule, so a deletion is not complete until they roll past it. We tell a family that plainly rather than saying “deleted” early.
- Has it been independently tested?
- Not yet. No penetration test or external audit has been performed, and we are not SOC 2 attested. Every statement on this page is self-assessed against the code. An independent test, then a SOC 2 Type I, are the next steps in the security program, and this answer changes when they are done.
- How do we verify any of this?
- Ask for the security program. It is written to be checked, not believed: every claim names the part of the platform that makes it true. Your counsel, your bank or your IT function can read it and ask us anything it leaves open.