Trust / Your data
Your data
We handle business accounting and bank-transaction data, and for some clients investment and portfolio data.
One database per client, isolation verified by a test.
Each client's data lives in its own PostgreSQL database, reached by its own credentials, so one client's dashboard or AI connection cannot see another's. An automated test asserts that each client sees only its own rows and that a misconfigured connection is rejected. It runs in CI on every change.
Where personal information is in the AI's reach, it is tokenised first.
Most engagements put no personal information in front of the AI; it reads reconciled business figures. Where an engagement does, identifying fields are replaced with opaque tokens before any data reaches the model, and an automated tripwire blocks bulk identity lookups. The control is per engagement and is in production today.
Hosted in managed cloud, with stored documents in the EU.
Databases run on Render (managed PostgreSQL). Raw data and documents are stored on Cloudflare R2 in the European Union. Nothing is held on local machines.
Encrypted at rest and in transit.
AES-256 at rest (platform-managed) and TLS 1.2+ in transit. Daily database backups are taken, and a restore has been drilled with a known recovery time (see compliance).
You can revoke access, export your data, or have it deleted.
You can revoke our access to your accounting system at any time, which stops further processing. You can take a full export of your data in a standard format. When an engagement ends, your database can be deleted in full.
Phase Transitions owns its infrastructure and IP.
The company owns its intellectual property and is the controlling, beneficial owner of the accounts its infrastructure runs on. Under POPIA it acts as your operator; you remain the responsible party.