Your documents are never used to train models.
How AI touches your data
Advisare runs on frontier models, so this deserves precision, not reassurance. The commitments:
- Your content goes to an AI provider solely to generate the output you asked for.
- Under our provider agreements, it is never used to train their models.
- It is not retained by a provider beyond what a single request requires.
- Your details are never sold or shared. That line is on our demo form; it applies to everything.
Encryption
All traffic is encrypted in transit with TLS, and strict transport security is enforced — there is no unencrypted path to the platform. Data is encrypted at rest, and credentials for the systems you connect (SharePoint, Box, Microsoft) are additionally encrypted before they are stored.
Tenant isolation
Every firm is its own organization, and every record — documents, fields, scores, memos, events — is scoped to it. Isolation is enforced twice: once in the API layer, and again in database-level permission rules.
The AI agents inherit the same boundary. An agent works with a fixed set of tools scoped to the single deal and organization it was invoked on; there is no tool that reaches across firms.
Access controls
Sign-in uses one-time codes sent to your work email — there are no passwords to phish, reuse, or leak. Access within the platform is role-based, and every API request is logged with user context. Deal history is an append-only timeline: nothing is edited away, which is the point of a system of record.
SSO / SAML is available on the Enterprise tier, so your identity provider — and its session, MFA, and offboarding policies — governs who can reach Advisare at all.
never sold · never shared · never used to train models
Retention and deletion
Your data stays as long as your firm’s account is active — a permanent record is what you are paying for. When you leave, your organization and its records are deleted on request within 30 days, backups age out on their own cycle, and the memos and decks you exported remain yours. Details are in the privacy policy.
Subprocessors
Everyone who processes your data on our behalf, under data processing agreements. All production data stays in the United States.
Public business registries (SEC EDGAR, UK Companies House, SAM.gov, OpenCorporates) receive only the search terms needed to answer a query — never your documents.
SOC 2 status
SOC 2 certification is on our roadmap. Until the report exists, we will answer your diligence questionnaire line by line and walk your security team through the architecture directly.
Bring your diligence questionnaire.
We'll answer it line by line, and show your security team the controls live.