Security
We take the security of your financial data seriously. Here is how we protect your information.
Security Architecture
┌─────────────────────────────────────────────────────────────────────────────────────────────┐ │ Platform Core │ ├─────────────────────────────────────────────────────────────────────────────────────────────┤ │ │ │ ┌──────────────┐ ┌──────────────┐ ┌──────────────┐ ┌──────────────┐ │ │ │ Org-A │ │ Org-B │ │ Org-C │ │ Org-N │ │ │ │ (Tenant) │ │ (Tenant) │ │ (Tenant) │ │ (Tenant) │ │ │ └──────┬───────┘ └──────┬───────┘ └──────┬───────┘ └──────┬───────┘ │ │ │ │ │ │ │ │ ▼ ▼ ▼ ▼ │ │ ┌──────────────┐ ┌──────────────┐ ┌──────────────┐ ┌──────────────┐ │ │ │ MCP Subproc A│ │ MCP Subproc B│ │ MCP Subproc C│ │ MCP Subproc N│ │ │ │ (Isolated) │ │ (Isolated) │ │ (Isolated) │ │ (Isolated) │ │ │ │ │ │ │ │ │ │ │ │ │ │ QB Creds A │ │ QB Creds B │ │ QB Creds C │ │ QB Creds N │ │ │ └──────────────┘ └──────────────┘ └──────────────┘ └──────────────┘ │ │ │ │ Each subprocess runs in its own memory space. No shared state between orgs. │ │ ERP OAuth tokens are isolated per subprocess. Tokens never cross tenant boundaries. │ │ │ └─────────────────────────────────────────────────────────────────────────────────────────────┘ ┌─────────────────────────────────────────────────────────────────────────────────────────────┐ │ Surface-Based Tool Routing │ ├─────────────────┬────────────────────────────────────────────────────────────────────────┤ │ CHAT Surface │ Read-only tools only (search, lookup, summarize). No write-back. │ │ PIPELINE │ All tools + HumanReviewNode. Write operations paused for approval. │ │ WRITE Surface │ ERP write-back with explicit confirmation step. │ └─────────────────┴────────────────────────────────────────────────────────────────────────┘
Encryption at Rest
All stored data is encrypted at rest. Financial documents and transaction files are held in encrypted object storage, and the platform database is encrypted as provided by our cloud hosting providers.
Encryption in Transit
All data transmitted between your systems and our platform uses TLS 1.2 or higher. We enforce TLS on all API endpoints and service-to-service communication.
Cloud Hosting
Our infrastructure runs on Railway, with Neon Postgres for the relational database, Redis for the job queue, and object storage for financial files. Physical security and network protection are provided by these hardened infrastructure providers.
Access Controls
Role-based access control (RBAC) with fine-grained permissions. Multi-factor authentication (TOTP) is available for user accounts. All access is logged and auditable. SSO/SAML support is on our roadmap for enterprise plans.
Tenant Isolation
Each organization operates in an isolated tenant environment. Cross-tenant data access is architecturally prevented, and ERP credentials are scoped per organization with no shared state between tenants.
CCPA Alignment
We do not sell personal information, and we honor consumer rights requests — including access, deletion, and opt-out — under the California Consumer Privacy Act. Contact our privacy team to submit a request.
Compliance and Certifications
SOC 2 Type II (Roadmap)
SOC 2 Type II certification is on our compliance roadmap. Our security architecture — encryption at rest and in transit, per-org tenant isolation, and immutable audit logging — is built around SOC 2 trust principles (security, availability, confidentiality), and we intend to pursue formal third-party certification as the company scales.
CCPA Alignment
We do not sell personal information, and we honor consumer rights requests — including access, deletion, and opt-out — under the California Consumer Privacy Act. Contact our privacy team to submit a request.
GDPR Readiness
While we are focused on the US market, our platform architecture and data handling practices are designed to support GDPR requirements for customers who need them.
Advanced Security Controls
Security Practices
We follow secure development practices and maintain a formal incident response process. As a pre-launch company, we do not yet operate a bug bounty program or a recurring third-party penetration testing program — both are on our roadmap as we scale — but we investigate and respond promptly to any vulnerability reports we receive.
Access to production systems is limited to the small team of engineers who need it to operate the platform. Formal employee security-training and background-check programs are on our roadmap as we grow the team.
In the event of a security incident involving your data, we will notify affected customers within 72 hours of confirmation, in accordance with our incident response policy and applicable legal requirements.
Report a Vulnerability
If you believe you have found a security vulnerability in our platform, please report it to us immediately. We appreciate responsible disclosure and will work with you to confirm and remediate any issues.
Security Contact
security@finadvantage.online