Trust & technology
Security & data handling
Understand the controls, their boundaries and the evidence to request before placing a firm's confidential work in the product.
Search the public guides. Your search stays in this browser.
On this page
Access is checked by the service.
Each report operation checks the verified account, workspace membership, license and seat. Roles restrict permitted actions. Invitations and connected sign-in methods do not create a shortcut around those checks.
Workspace administration and internal operations use distinct administrative responsibilities, recorded in activity history. Internal administrator status alone does not grant report access.
Storage has different boundaries on each surface.
Scroll horizontally to read the full table.
| Location | Protection and boundary |
|---|---|
| Cloud | Reports and application records are stored in a private Cloud SQL database in Google Cloud's Iowa region. Traffic to the service is encrypted in transit, and Google encrypts stored data at rest. |
| Desktop | The current implementation encrypts supported workfiles using a key protected by macOS Keychain or Windows Data Protection. Exported files leave that application protection. |
| Native iPhone / iPad | Notebooks use application encryption with a device-local Keychain key. Standalone exported measurement files have a different protection boundary. |
| Browser | Local persistence depends on the installed web build and browser. It is not equivalent to native Keychain protection, and clearing or eviction can remove unsynced work. |
| Exports | PDFs, backups and shared measurement files are under the firm's control after export. Apply the firm's storage and sharing rules. |
Device encryption does not protect an already compromised or authorized application session. Exported PDFs and backups are not encrypted by the app.
These controls do not make the service end-to-end encrypted: authorized cloud processing needs access to report content. Build-specific details, provider processing and retention are covered by the privacy policy and should be confirmed during evaluation.
Know which services participate.
Google Cloud provides hosting, storage, authentication and AI text screening. OpenAI processes requested narrative and report-check context. Other integrations serve narrower purposes, including address and parcel lookup, connected sign-in and account email delivery.
The privacy policy is the public reference for provider-specific data flows, retention and deletion requests. This overview does not replace it. A database region does not imply that every authentication or AI provider processes data only in that region.
Enterprise evaluation should ask for evidence.
The product is in pilot. These pages document controls and design choices; they do not claim SOC 2 or ISO 27001 certification, a completed independent audit, enterprise SSO/SCIM, contractual uptime or verified recovery objectives.
- Confirm the supported release and device-management requirements.
- Review data-processing terms and the current provider list.
- Ask about retention, deletion and demonstrated backup restoration.
- Agree on incident contacts, support scope and required service commitments.
- Confirm how the firm's own review, recordkeeping and delivery requirements will be met.
Appraiser review, standards validation and lender acceptance are separate from infrastructure security. None is implied by the others.
Public detail, with a deliberate boundary.
We publish the application's responsibilities, technology choices, model information, material data flows and release limitations. That gives prospective customers a basis for meaningful technical questions.
Proprietary prompts and evaluation methods, customer records, credentials, internal service addresses and operational procedures stay out of the public docs. Additional diligence material can be discussed through an appropriate private channel.
For a security concern or evaluation request, contact support@jarodvyent.com. Arrange a secure transfer before sending sensitive data.