Security

What we do with your deals, in plain words. If a claim is not on this page, we are not making it.

Your account

• Sign in with a password or an emailed link. Passwords are at least 10 characters and are stored hashed by the authentication service; we never see them.
• Two-factor authentication with an authenticator app, turned on from Settings › Security and asked for on every new sign-in.
• Active sessions are listed in Settings › Security, and you can sign out every other device from there.
• Export your profile, preferences, accounts and plan as JSON at any time. Deals are not in that file. Request deletion of everything — your account, every account you own and every deal in them. We delete your account 30 days after you request deletion. You can cancel the request any time before then.

Your data

• Every table is protected by row-level security in the database, in force from the first migration: a user reads only their own profile and the accounts they belong to, and the policies are covered by tests.
• Your deal data is never used to train AI models.

Sharing

You can send a share. The recipient gets a private copy and cannot write the sender’s model; that is enforced in the database and in the calculation engine. A withheld section is absent from the recipient’s copy, and every figure it would state is removed on our servers before that copy is built — both from what we send them and from the rows their own session is allowed to read — so the decision is never one the recipient’s browser could be talked out of. That is a rule about what the model states.

It is not a claim that a withheld figure cannot be worked out.

A recipient given the operating statement and the debt can derive the equity return, and the methodology page sets out how, and what stays out of reach.

What we do not claim yet

A SOC 2 report is claimed only once an auditor is engaged.