Security
Security designed for professional financial research workflows.
This page describes controls that are in the product today, work that is underway, and enterprise capabilities that are on the roadmap. We do not claim certifications or deployment options that are not yet in place.
Available today
Encrypted at rest and in transit
Application traffic is served over TLS. Customer data stored in our database and object storage is encrypted at rest by our infrastructure providers.
Customer data is logically isolated using row-level security
Postgres row-level security policies restrict access to a user’s own records and to workspaces they have been invited to. Other customers cannot query your coverage books, documents, or chats.
Authentication
Email/password and Google sign-in via Supabase Auth. Session cookies are used to keep you signed in on this site.
Workspace sharing
A workspace owner can invite editors and viewers. Access is scoped to that workspace — not a blanket org-wide permission model.
Internal activity logging
The application records selected actions (for example project creation and document upload) for operational tracing. These logs are not currently offered as a customer-exportable audit log.
Data encryption
Data is encrypted at rest and in transit. Transit uses TLS on the application and API connections. At-rest encryption is provided by our hosting and database providers (currently Vercel for the application and Supabase for Postgres, auth, and storage). This is not end-to-end encryption: the application must decrypt data to index documents and generate research responses.
Customer data and model training
We do not use customer documents, chats, or research outputs to train our own models. When you run research, selected excerpts and prompts are sent to model providers (OpenAI and Anthropic) so they can generate a response. Provider handling of API traffic is governed by their terms. We do not currently operate a contractual zero-retention arrangement with those providers, and we do not claim that prompts never leave our systems.
Tenant isolation
Customer data is logically isolated using row-level security. Users see their own profile, workspaces they own, and workspaces they have been invited to. This is logical isolation in a shared application and database — not a physically isolated tenant, VPC, or dedicated cluster.
Data retention and deletion
Workspace documents, chats, and research artifacts are retained until you delete them in the product or request deletion. There is not yet a self-serve “delete my account” control. To request deletion of an account and associated research data, email contact@institutionalanalytics.com. Backup copies held by infrastructure providers may persist for a limited period after deletion.
Subprocessors and infrastructure
The product currently relies on:
- Vercel — application hosting
- Supabase — authentication, Postgres, file storage
- OpenAI and Anthropic — model inference and embeddings
- Stripe — Pro subscription billing, when a customer upgrades
- Inngest — background document and extraction jobs, when configured; otherwise jobs run in-process
- Resend — transactional and inquiry email, when configured
- SEC EDGAR — public filings
- Finnhub and other news sources — coverage news and alerts, when API keys are configured
See data handling for a fuller description of how research content moves through the product.
In development
- Self-serve account deletion from settings
- A shared team template library (templates today are saved per user)
- Org-level admin roles beyond workspace owner, editor, and viewer
Enterprise roadmap
The following are not available today. We list them so buyers can see the intended path rather than infer capabilities from the product name.
- SOC 2 Type II
- SSO / SAML
- VPC or dedicated deployment
- Customer-exportable audit logs
Security contact
Report a vulnerability or ask a security question at contact@institutionalanalytics.com. Please do not include customer credentials or production portfolio data in the initial message.