Security & deployment
Answers to the questions your IT team will ask.
You are handing us client financial data under a professional duty of confidentiality. This page states what is true today, and marks clearly what is planned rather than built.
Deployment
| Model | What it means | Status |
|---|---|---|
| Self-hosted / on-premises | Runs inside your infrastructure. Client data never leaves your environment. | Built |
| OSO-hosted cloud | We host, with a dedicated database per firm and a signed methodology-pack channel. | Built |
| Hybrid — your own cloud subscription | Runs in your tenancy with customer-managed keys and break-glass alerting. | Designed, not shipped |
We mark the third as planned deliberately. Audit firms verify claims, and a vendor who overstates deployment maturity is telling you something about how they will describe everything else.
The audit trail
Append-only, tamper-evident
Entries are chained with keyed hashes. Records cannot be quietly edited or removed after the fact — alteration breaks the chain.
Evidence-embedded archive
Long-term preservation format with the supporting evidence embedded, not referenced by a link that will rot.
Reproducible computation
Deterministic results are signed and re-runnable, distinguishing a genuine match from data drift or tampering.
Access control
Multi-factor authentication for privileged roles, and enterprise SSO via SAML so your identity provider stays the source of truth.
We verify the IdP's MFA claim
Where SSO is used we read the identity provider's own multi-factor assertion rather than accepting an assurance that it was configured. A checklist is not a control.
How we test the isolation claim
Tenant separation is enforced at the database layer through row-level security, not only in application code — so a bug in a query cannot silently return another firm's rows.
We test that adversarially rather than assuming it. Isolation is asserted through a deliberately unprivileged database role, because a privileged connection bypasses row-level security entirely — a test run that way would pass without proving anything.
Compliance posture — stated plainly
We are not SOC 2 certified today. A SOC 2 Type 2 examination covering Security and Confidentiality is planned, and the technical controls it depends on are already in place. We will say we hold it when we hold it, and not before.
If a procurement process requires a completed report before a pilot can begin, tell us early — that changes the sequence, and we would rather know at the start than at signature.
Security questions
Send us your questionnaire.
We would rather answer it early and lose fast than discover a blocker at signature.