Trust / Your data
Your data
On the accounting platform: business accounting and bank-transaction data, and for some clients investment and portfolio data. On WealthVault: the per-product client statements an advisory firm's advisers upload. On the trading tool: an investment manager's fund trade and flow records.
One database per client, isolation verified by a test.
Each client's data lives in its own database, reached by its own credentials, so one client's dashboard or AI connection cannot see another's. On the accounting platform that is one PostgreSQL database per client. WealthVault and the trading tool are single-tenant deployments, each in its own cloud account or subscription. An automated test asserts that each client sees only its own rows and that a misconfigured connection is rejected. It runs in CI on every change.
Where personal information is in the AI's reach, it is tokenised first.
Most accounting engagements put no personal information in front of the AI; it reads reconciled business figures. Where an engagement does, identifying fields are replaced with opaque tokens before any data reaches the model, and a tripwire blocks bulk identity lookups. On WealthVault every direct identifier is tokenised before the AI boundary and the token map stays in South Africa.
Hosted in managed cloud, in the EU and in South Africa.
The accounting platform runs on Render in Frankfurt, with raw data and documents on Cloudflare R2 in the European Union. WealthVault runs on AWS in Cape Town, with no cross-region replication. The trading tool runs on Microsoft Azure in South Africa North (Johannesburg), with no geo-redundant backup out of the region. Its sign-in uses Microsoft Entra ID, whose directory data is stored in the EMEA geography, as it is for every Entra tenant registered in South Africa.
Encrypted at rest and in transit.
AES-256 at rest and TLS 1.2 or higher in transit on all three platforms. WealthVault's database, backups and token vault sit under customer-managed keys. Databases are backed up daily, and a restore has been drilled with a measured recovery time (see compliance).
You can revoke access, export your data, or have it deleted.
You can revoke our access to your source system at any time, which stops further processing. You can take a full export of your data in a standard format. When an engagement ends, your database can be deleted in full; the deletion procedure has been drilled end to end.