Security
Specifics you can verify, not adjectives
You evaluate vendors for a living, so you already know that “bank-grade” and “military-grade” mean nothing. This page lists exactly what protects the information you give us and what protects the systems we build for you, in terms precise enough to check.
It also says plainly what we have not done yet. A security page that claims everything is a security page that tells you nothing.
How this website protects your information
Filling in a form here should not create a new risk for your firm. Seven controls, each one either true or false rather than a matter of opinion.
Encrypted in transit, with no plaintext option
Every page and form is served over TLS. The site sends a strict transport policy header, so a browser that has visited once will refuse to connect over plain HTTP afterward, even if someone hands you a tampered link.
The database rejects the browser entirely
Row-level security is on for every table holding your information, and the anonymous and signed-in browser roles have no read, write, or delete access to any of them. Every write goes through a server-side endpoint. Extracting a key from the page source gets an attacker nothing.
Gated documents are not quietly public files
The PDFs sit outside the web root and are delivered only through expiring links signed with HMAC-SHA256. A guessed URL, an edited URL, or an expired one is refused. This is a common failure on gated-content sites, and it is worth checking on your own.
No third-party tracking of any kind
No Google Analytics, no advertising pixels, no session recording, no data brokers, no ad-network tags. One first-party cookie records how you found us and expires in 90 days. Your visit is not sold, syndicated, or retargeted.
Forms are hardened against automated abuse
Rate limiting per address, a bot honeypot, and rejection of disposable domains. Bot submissions get a normal-looking response and are discarded rather than stored.
Credentials never live in source code
API keys and database credentials are held in the hosting platform's encrypted environment store, injected at runtime, and absent from the repository and from anything shipped to your browser.
The site cannot be wrapped by someone else
Framing is denied outright, so this site cannot be embedded inside a lookalike page to harvest what you type. That closes off clickjacking and a common credential-phishing pattern.
What this site never asks for
The strongest protection for client data is not collecting it. Our forms ask about your firm and the process costing your team the most time. They do not ask for anything covered by Regulation S-P, so a breach here could not expose your clients.
- Client names, addresses, Social Security numbers, or dates of birth
- Account numbers, portfolio holdings, or balances
- Custodian, CRM, or portfolio-system logins
- Uploaded client documents or statements
When an engagement genuinely requires access to client records, it happens inside your systems under your agreements, never through this website.
How we secure what we build for you
The website is the easy part. These are the commitments that apply once we are working inside your firm's systems.
It runs in your environment
Systems we build live in infrastructure your firm owns and controls, under your own agreements. There is no multi-tenant product, so your data never sits in a pool with another firm's.
Your data does not train anything
We use enterprise API tiers where the provider contractually excludes your inputs from model training, and we show you the terms rather than asking you to take our word for it.
Least privilege, scoped per integration
Each connection gets the narrowest permission that does the job, read-only wherever reading is enough, with separate credentials per system so one exposure does not become total access.
Every automated action is logged
Timestamp, trigger, inputs, output, and the person who approved it. That record is what makes supervision demonstrable instead of asserted, and it is what an examiner will ask to see.
A working kill switch
Anything that can act on its own can be stopped by a named person without a developer, and we test that path with you before the system handles real work.
The same reasoning drives the governance and assurance work: controls only count if you can produce evidence of them on request.
Honest limits
What we do not claim
We are not SOC 2 certified and we are not going to imply otherwise. We are a small firm, that audit is on our roadmap rather than behind us, and you deserve to know which before you share anything.
We have not had a third-party penetration test of this website. It collects no client data, which is the reason we have prioritized other work, and we would rather tell you that than let a badge suggest a test happened.
We are not a custodian, broker-dealer, or law firm. We never hold client assets and never move money. Your CCO and counsel remain the authority on your compliance program.
If another AI vendor tells you their product is “fully compliant” or “SEC approved,” ask them for a page like this one. No regulator approves software, and the answer will tell you a great deal about who you are dealing with.
Found a problem? Tell us.
If you spot a vulnerability, email info@expertailabs.com with enough detail to reproduce it. We will confirm receipt within one business day and tell you what we found and when it was fixed. We will not threaten anyone who reports something in good faith.
Doing diligence on us for your firm? Ask on your first call and you will get direct answers, including to the questions this page does not cover.