Security & trust
No logins. No guesses.
Every number is one you approved.
This page says what we built, not what we feel. Nine promises, stated the way the finished product makes them.
-
01
Nothing to steal
We never ask for a brokerage login, so we never store one. On our worst day, an attacker who got everything would still not hold a single credential that can move your money — because no such credential exists in our systems.
-
02
We can't touch your money
No custody, no trading access. Trading rules draft orders; you place them. The one planned exception — the opt-in Schwab connection — uses scoped OAuth you grant explicitly and can revoke at the broker, and it is never the default.
-
03
Your data is yours
Export the full ledger and every original document at any time, in formats that work without us: CSV, JSON, the files themselves. Close your account and everything is deleted — originals, extractions, derived data — with backups aging out on a published schedule. No export ransom, no quiet retention “for analytics.”
-
04
We sell software, not you
The business model is a subscription. We don't sell data, don't show ads, and don't sell “anonymized” datasets to funds, marketers, or anyone else. You are the customer, not the product.
-
05
AI on a short leash
Your documents go to the model for extraction, under agreements that prohibit training on your data, and for nothing else. Every AI call is logged and traceable to the document that triggered it. No human reads your documents unless you grant access during a support conversation — and that access is logged too.
-
06
Isolation in the database, not just in the app
Every row of your data is tenant-scoped with row-level security enforced by Postgres itself, and your requests run under your own identity rather than a master key. A bug in application code cannot read another tenant's data, because the database refuses.
-
07
Encryption everywhere, boring on purpose
TLS in transit, encryption at rest for documents and the database, passkeys and two-factor authentication for your account. Nothing novel, nothing clever; security is one place where boring is the feature.
-
08
Every number has a receipt
Each balance is the sum of transactions you approved; each transaction traces back to a document you provided. The audit trail isn't a premium feature — it's how the arithmetic works.
-
09
Audited, eventually, by someone who isn't us
An independent security audit and SOC 2 are on the roadmap before we ask anyone to trust us at scale. Until then, this page says what we built — not what we feel.
Trust is the product
Join the waitlist with a verified email — verified, because every number here should be one you approved — and get 10% off, for life.