Security
How your clients’ data is kept separate.
You are being asked to put your clients’ plan data into someone else’s system. Below is specifically how it is kept apart from every other firm’s — described plainly enough that your diligence team can ask us hard questions about it.
- 01
Every record belongs to exactly one firm
Every tenant-scoped table carries its owning firm, and each admin request resolves records through that firm rather than by bare identifier — so a request carrying another firm's record id finds nothing rather than returning that firm's data. Scoping happens at the point of the query, not as a filter applied afterwards.
- 02
Generated SQL is fenced at the database itself
Ask-your-data is the one place the system executes SQL it wrote, so it gets a layer the rest of the application does not rely on. The SQL is validated before it runs — SELECT only, against an explicit table allowlist, with a column blocklist — then executed inside a read-only transaction under a statement timeout, with the asking firm set on the database connection. Postgres row-level security policies then return only that firm's rows, whatever the query asked for. We put the database-level control where generated SQL runs, which is where the risk actually is.
- 03
Internal notes never reach the participant assistant
Your notes on a client or plan are excluded from the context assembled for participant chat. They are not redacted afterwards — they are never gathered in the first place. Participants reach exactly one plan — by scanning that plan's custom QR code or entering its custom access code — and nothing beyond it.
- 04
Accounts are per person, with lockout
Named accounts rather than a shared password, and no public sign-up — every account is created by an administrator. Passwords are reset by email, and an account locks after ten failed sign-in attempts until it is unlocked from an emailed link. Access comes in three tiers, and a firm administrator manages their own colleagues without being able to see or affect any other firm.
- 05
Documents are stored outside the application
Uploaded plan documents and generated materials are held in Google Cloud Storage, not on the web servers. Files are reached through long, unguessable links, and the storage address each link hands off to expires within minutes. Anyone holding a link can open the file, so treat a shared link like the file itself.
- 06
Encrypted in transit, with named processors
Every connection to the platform is forced onto HTTPS. The application and its Postgres database run on Heroku in the United States. Participant chat and document reading use Google's Vertex AI (Gemini), and email is sent through Postmark. Narrated videos send the plan overview's slide text to ElevenLabs and OpenAI for the voice and to OpenRouter for translation — the overview, not participant records.
Send us your security questionnaire.
We would rather work through it before you commit than after. Email it over or raise it on the demo call.