Platform · Security
Institutional-grade security, by default.
We work with the data your IC trusts least to leak — so we designed for the compliance bar of institutional finance from day one.
Six pillars
What's in the security model.
SOC 2 Type II
Independently audited controls across security, availability, processing integrity, confidentiality, and privacy.
Encryption everywhere
AES-256 at rest, TLS 1.3 in transit. PII encrypted at the application layer — never logged in plaintext.
Secrets isolation
Connector credentials stored in GCP Secret Manager, referenced by pointer — never stored in our database.
Immutable audit trail
Every data access, every financial mutation, every AI generation — recorded to an append-only log with 7-year retention.
MFA & RBAC
Mandatory MFA for account settings and sensitive actions. Role-based access with per-resource authorization checks.
MNPI guardrails
Real-time MNPI detection on expert interviews; compliance prompts and escalation paths trained on institutional policy.
Compliance posture.
Honest labels — what's certified, what's in progress, and what's on the roadmap.
Need the full security pack?
SOC 2 report, pen-test summary, data-flow diagrams, SIG Lite, and vendor DPA — available under NDA via your account team.