Security & Compliance Posture · SOC 2 in progress
Security architecture & data custody.
Tenant isolation, full 64-hex SHA-256 study seals, server-side entitlement gates, and our current security review status (SOC 2 in progress).
Security Posture
Verifiable controls today. SOC 2 in progress.
We state our security posture plainly: tenant-scoped encryption, zero raw-dataset ingestion on CLI sync, and deterministic numeric guards are live today, while our formal attestation is SOC 2 in progress.
01
SOC 2 in progress
Formal audit preparation and control evidence collection are underway (SOC 2 in progress). Download our technical Regulation S-P & Rule 204-2 architecture pack below.
02
Tenant-scoped encryption & purge
Uploaded price series are encrypted at rest per tenant, never pooled across accounts, and can be exported or purged in full (`DELETE /api/me/data`).
03
Local-first math boundary
The alphaengine library and its math run offline; login, workflows, reporting and sealing use the network; full return series are sent only with --share-series.
04
Server-enforced entitlements & MFA admin
Plan entitlements are resolved exclusively on the server. Org-scoped `ae_live_` keys are Firm-only and hashed at rest; administrative routes require Supabase `app_metadata.role = 'founder'` plus an `aal2` MFA session.
Vendor due-diligence pack for CCOs & allocators.
Built for small and mid-sized SEC-registered investment advisers navigating Regulation S-P vendor oversight, Rule 206(4)-1 marketing substantiation, and Rule 204-2 research books-and-records exams.
Informational technical summary only — not legal advice. Controls are designed to support compliance workflows pending counsel review.
Security review & vendor due diligence
Institutional Firm pods receive direct architecture review support. See Access & Pricing or Trust & Custody.