Built like the records it keeps.
A wealth file holds the softest data a firm touches inside the hardest regulatory frame. The architecture answers were made before the features were.
Row-level security enforced in the database. Agents reach firm data only through a narrow tool surface, with a token per firm. Connectors read by default; the few things they write are named in the register below.
A quote is checked against the source text, not graded by the model. Confirmed facts are never overwritten — a correction supersedes and keeps the history. Facts that fail the check are held in the open.
Today an approved artifact downloads as its archived document, and a CCO can pull an evidence pack. A full export of notes and firm data is planned. We do not train models on client data.
What exists today, and what we intend to contract on
Export
Today: an approved artifact downloads as its archived document, and a CCO can pull an evidence pack for a review or an exam. Planned: advisor-authored notes exportable at any time in a documented format, attributed, without vendor approval or fees, and a full firm export on termination. The review pack says which are ready.
Escrow
Full firm data held with an independent escrow agent, released to the firm on termination or vendor failure. Planned: no escrow agent is appointed yet.
No training
We do not train or fine-tune any model on client transcripts, notes or artifacts. Deepgram is called with its model-improvement opt-out set.
Subprocessors & notice
The register is below, on this page — every processor that receives client data, and what reaches it. We intend to give 30 days’ notice before a new processor receives client data, with a right to terminate on objection.
Retention & books-and-records
Client records are kept no longer than six years, the books-and-records period under SEC Rule 204-2. Approved artifacts are archived write-once, and a CCO can place a retention hold on a household. A few things are removed sooner: imported files and our copy of meeting recordings after 90 days, draft previews after 30. Within 30 days of a written request from the firm, its or a household’s data is removed from our live systems and our providers are instructed to delete it. Rule 204-2 records (the Record, the access ledger, approved pieces’ archived copies) are kept six years from each record’s date, then deleted, and legal holds are excepted. Backups and logs are not edited; they expire on their own schedule (database backups after 35 days, manual database exports within six weeks, cache snapshots after 7 days, the cross-region copy after a year, logs after 365 days), so everything expires within about 13 months, and deletions are re-applied after any restore. The privacy policy has the detail. A retention schedule your firm sets is planned.
NO SOC 2 REPORT — NOT TYPE II, NOT TYPE I. WE ARE BUILDING THE CONTROLS; NO AUDITOR IS ENGAGED AND NO OBSERVATION WINDOW HAS STARTED. THE REVIEW PACK SAYS WHICH CONTROLS EXIST TODAY.
IF A PROMISE ON THIS PAGE IS NOT IN YOUR CONTRACT, TREAT IT AS NOT MADE — AND TELL US, BECAUSE THAT IS A BUG IN THE PAGE.
The subprocessor register
Every third party we send client data to, what it does, and what reaches it. Systems your firm already runs, which we connect to on your authority, are listed separately below.
| Processor | What it does | What reaches it | Status |
|---|---|---|---|
| Anthropic | Runs the agents and the model calls that read transcripts and email, summarise meetings, draft client emails and documents for review, answer advisors in Slack, and search the web for prospect research. Agent sessions are deleted 30 days after they end. | Meeting transcripts, client email an advisor forwards, advisor requests from Slack and email, the household, holdings and CRM records an agent looks up or drafts from, the memory an agent keeps for a household, and, for prospect research, a prospect’s name, title, employer and city. | In use |
| Amazon Web Services | Hosting, the database, file storage and outbound email. | Every record the product holds. | In use |
| OpenAI | Turns household facts and search words into numbers, so facts can be searched by meaning, where the firm turns it on. In staging only, voices the narration of videos a reviewer has approved. | Each fact’s household name, label and text, and the words of each fact search, including searches from Claude. In staging, the approved narration script. | In use |
| ElevenLabs | Voices the narration of videos a reviewer has approved, where the firm turns video on. It replaces OpenAI for narration once the switch is made; until then OpenAI voices them. | The reviewer-approved narration script of a video. | Switching on |
| Recall.ai | Sends the notetaker to an advisor’s video meeting, where the firm turns it on, and records it. Deletes its copy once ours is saved, within 72 hours at most. | The meeting’s audio, video and captions. Our copy of a recording is deleted after 90 days. | In use |
| Deepgram | Transcribes recorded meetings and advisor voice notes. | Meeting and voice-note audio. | In use |
| Sentry | Reports errors from the app and the browser, so we see a failure before you do. | Error messages and stack traces, and the page or request path they came from. Query strings, request bodies, cookies, variable values, user identity and IP addresses are removed before sending. | In use |
| Twilio | Text messages to Tenuit staff. | No client data; clients are never texted. | Staff only |
| Cloudflare | DNS. | No client data. | In use |
| Slack (our workspace) | Posts staging and production alerts to our own engineers, who can search those logs from there. | Log lines, which can include client data. | In use |
CURRENT AS OF 25 OCTOBER 2026, CHECKED AGAINST THE DEPLOYMENT CONFIGURATION THAT DAY. WHEN WHAT RUNS CHANGES, THIS REGISTER AND ITS CHANGE LOG ARE UPDATED.
These are yours already. Your firm or advisor authorises each connection and can withdraw it. Connectors read by default and write only what is named here; nothing a connector reads is filed as an advisor’s note. To connect Microsoft 365, your IT admin registers Tenuit as an app in your own Microsoft tenant.
| System | What we read | What we write | Status |
|---|---|---|---|
| Microsoft 365 | Advisor mail, calendar and meeting recordings. | A prep link on the meeting’s calendar event. A reply draft in the advisor’s own mailbox, sent only once they approve it. | Connected |
| Slack | Channels and direct messages the Tenuit app is in. | Answers in the thread an advisor asked in. | Connected |
| Google Workspace | Sign-in, calendar, Drive recordings and Gmail. | A prep link on the meeting’s calendar event, where the firm turns it on. Gmail is read and processed mail marked read; reply drafts are saved for the advisor and sent only if the firm turns auto-reply on. | Trusted by your admin |
| Salesforce | Households, contacts, and their notes and tasks. | Where the firm turns it on: notes, tasks and contact updates, each marked as recorded in Tenuit by the advisor. | Not yet open |
| Wealthbox | Households, contacts, and their notes and tasks. | Where the firm turns it on: notes and tasks, each marked as recorded in Tenuit by the advisor. | Available |
| Altruist | An advisor’s households, accounts and positions. | Nothing. | Staging only |
| Custodian file feeds | The scheduled position and account files a custodian sends. | Nothing. | Available |
| Other CRMs | Households, contacts and their notes. | Nothing. | Not yet open |
| Schwab | A positions CSV the advisor exports and uploads. | Nothing. | CSV upload |
Three more sit behind this website rather than behind the product. No client record reaches any of them.
| Processor | What it does | What reaches it | Status |
|---|---|---|---|
| GitHub Pages | Hosts this website. | Standard request data, such as IP addresses. | In use |
| Formspree | Carries the form at the bottom of this page. | What you type into it. | In use |
| Cloudflare Web Analytics | Counts page views. Sets no cookie and builds no profile. | Page address, referrer, and coarse device type. | In use |
What has changed
- 2026-10-25
- Added ElevenLabs, which will voice the narration of approved videos in place of OpenAI once switched on in staging and production.
- 2026-10-25
- Slack now runs in production too: the assistant, for a firm that turns it on, and our alerts, which can include log lines from production.
- 2026-10-24
- Added OpenAI (fact search, and narration in staging), Recall.ai (the meeting notetaker), and our own Slack workspace for staging alerts. Widened the Anthropic row to drafting, meeting summaries, agent memory and prospect research. Added Wealthbox, Altruist and custodian file feeds to the systems your firm runs; Slack is staging only until the production app is set up.
- 2026-09-17
- Added Sentry, which now receives error reports from the app and the browser, with request data and identity removed first.
- 2026-09-16
- Added what went live on 2 September and was not yet listed: the Slack assistant, Salesforce write-back against our own test org, and forwarded client email reaching the agents. Added Google Workspace (test users), Schwab CSV upload, advisor voice notes to Deepgram, and GitHub Pages. Removed three vendors that were listed but never switched on.
- 2026-08-28
- Register first published. Before this the page claimed a list was published and none was.
- 2026-08-01
- Cloudflare Web Analytics added to the website. No cookie, no profile — recorded here because it processes visitor data.
EVERY ROW HAS ITS OWN ANCHOR — CITE ONE DIRECTLY, E.G. /security/#p-deepgram. A QUESTION ABOUT ONE ROW IS A GOOD QUESTION: HELLO@TENUIT.CO. THIS REGISTER IS A DISCLOSURE OF WHAT RUNS; THE CONTRACT IS WHAT BINDS. IF THE TWO DISAGREE, THE REGISTER IS THE BUG.
Read the architecture before you trust it.
The review pack sets out what exists today — tenancy, the archive, the register, retention — and which promises on this page are still planned.
Request the security review pack