Built like the records it keeps.
A wealth file holds the softest data a firm touches inside the hardest regulatory frame. The architecture answers were made before the features were.
Row-level security enforced in the database. Agent access through a narrow tool surface with per-firm vault tokens. Collectors are read-only by construction — they can fill the systems column, never write a note.
Quotes verified deterministically — string-match with stored character offsets, not model self-grading. Nothing overwritten, ever. Facts that fail verification are held in the open.
Advisor export in documented JSON/CSV — contractual, verifiable quarterly. Firm export on termination. Escrow is a term we will sign, not one signed yet. Transcripts never train shared models.
What we will put in writing
The export clause
Advisor-authored notes are exportable at any time, in documented JSON/CSV, attributed, without vendor approval or fees. Verifiable quarterly by the customer.
The escrow commitment
Full firm data escrowed with an independent agent, releasing to the firm on termination or vendor failure — so the file outlives the vendor. This one is not yet signable: Tenuit is a trade name and no legal entity is formed, so there is no party to be the depositor and no agent appointed. It is a term we will contract on formation. Until then, read it as intent, and hold us to the export clause above — that one stands today.
The no-training commitment
Client transcripts, notes and artifacts are never used to train shared or foundation models. Per-firm voice tuning stays per-firm.
Subprocessors & notice
The register is below, on this page — every processor that can touch a client record, what it does, and whether it is running today. 30-day advance notice of any addition or activation, with termination rights on objection — switching on a processor already listed as off counts, which is the whole reason the off ones are listed.
Retention & books-and-records
Audio and transcript retention follows the firm’s policy — a switch your CCO sets, not one we assume. Defaults to retain.
NO SOC 2 REPORT — NOT TYPE II, NOT TYPE I. WE ARE BUILDING THE CONTROLS; NO AUDITOR IS ENGAGED AND NO OBSERVATION WINDOW HAS STARTED. THE REVIEW PACK SAYS WHICH CONTROLS EXIST TODAY.
IF A PROMISE ON THIS PAGE IS NOT IN YOUR CONTRACT, TREAT IT AS NOT MADE — AND TELL US, BECAUSE THAT IS A BUG IN THE PAGE.
The subprocessor register
Every third party we send client data to, what it does, and whether it is running today. A row that is off is still listed — what could be turned on is part of the answer, not a footnote. Systems your firm already owns, which we read from rather than send to, are listed separately below.
| Processor | What it does | What reaches it | Status |
|---|---|---|---|
| In use | |||
| Anthropic | Runs the agents, holds per-firm session memory, and answers the direct model calls that read a transcript. | Meeting content and the household facts drawn from it. | In use |
| Amazon Web Services | Compute, the database, object storage for session recordings, and outbound mail. | Every record the product holds. | In use |
| Deepgram | Turns the audio of a recorded meeting into a transcript. Only meetings your firm chooses to record reach it. | Meeting audio. | In use |
| Cloudflare | DNS and the edge in front of the connector endpoint. | Request routing. No record is stored here. | In use |
| Not in use | |||
| OpenAI | Would compute the vectors that make a stored fact findable. It is not enabled: those vectors are computed on our own servers instead, and no fact text is sent. | Nothing. | Not in use |
| Twilio | Would deliver a message where a firm sends by text. Not enabled; there is no text channel today. | Nothing. | Not in use |
| Sentry | Would carry error reports so a failure is something we hold. Not enabled today. | Nothing. | Not in use |
CURRENT AS OF 28 AUGUST 2026. A PROCESSOR IS ADDED HERE BEFORE IT IS ADDED IN PRODUCTION, AND SWITCHED ON HERE BEFORE IT IS SWITCHED ON IN PRODUCTION.
These are yours already. Your firm authorises the connection and can withdraw it, we read on that authority, and the collectors cannot write a note back. We are not adding a processor to your stack here — we are reading one you have. One is connected today; the rest are built and not yet open, and are marked as such rather than listed as though they were ready.
| System | What we read | Status |
|---|---|---|
| Microsoft 365 | Advisor mail and calendar. | Connected |
| Google Calendar | Advisor calendar. | Not yet open |
| Salesforce | Households, contacts and the notes already on them. | Not yet open |
| Other CRMs | Households, contacts and the notes already on them. | Not yet open |
Two more sit behind this website rather than behind the product. No client record reaches either; they are listed because a register that stops at the product boundary is not a register.
| Processor | What it does | What reaches it | Status |
|---|---|---|---|
| Formspree | Carries the form at the bottom of this page. | What you type into it. | In use |
| Cloudflare Web Analytics | Counts page views. Sets no cookie and builds no profile. | Page address, referrer, and coarse device type. | In use |
What has changed
The file this product keeps is never overwritten, so neither is this. A register with one date and no history is a claim about today that cannot be checked tomorrow.
- 2026-08-28
- Register first published. Before this the page claimed a list was published and none was.
- 2026-08-01
- Cloudflare Web Analytics added to the website. No cookie, no profile — recorded here because it processes visitor data.
EVERY ROW HAS ITS OWN ANCHOR — CITE ONE DIRECTLY, E.G. /security/#p-deepgram. A QUESTION ABOUT ONE ROW IS A GOOD QUESTION: HELLO@TENUIT.CO. THIS REGISTER IS A DISCLOSURE OF WHAT RUNS; THE CONTRACT IS WHAT BINDS. IF THE TWO DISAGREE, THE REGISTER IS THE BUG.
Read the architecture before you trust it.
The review pack has the contract behind every promise on this page — export, the subprocessor register, no-training, retention — and says plainly which ones wait on entity formation.
Request the security review pack