Trust center

How Finiti protects your documents.

Certifications, security controls, sub-processors and the documents your security team will ask for. Questions go to our security team.

Last updated October 14, 2026

ISO 27001

Certified

Our information security management system covers development, deployment and operation of the platform.

SOC 2 Type II

Audit in progress

We are completing a SOC 2 Type II audit. The report will be shared under NDA once issued.

Penetration testing

External test completed

API and web application scope. A broader follow-up test, including the OWASP Top 10 for LLM applications, is in progress.

Incident notification

Within 72 hours

We notify customers of a security incident affecting their data without undue delay, and within 72 hours.

Documents

Policies and agreements.

Request any of these with the form below. Some are shared under NDA.

Privacy policy
How we collect and use personal information on our website and service.
View
Data processing agreement
Our standard DPA, including sub-processors, transfer terms and security measures.
Request
Service level agreement
Support hours, response targets and escalation.
Request
ISO 27001 certificate
Available on request.
Request
Penetration test summary
Scope and remediation status, shared under NDA.
Request
Security questionnaire
We complete law firm and company security reviews as part of onboarding.
Send yours

Security

Controls in place today.

Encryption

TLS 1.2 or higher in transit.
AES-256 at rest across databases, caches and document storage.
Platform-managed keys today. Customer-managed keys can be scoped for enterprise deployments.

Identity and access

Sign-in through Microsoft Entra ID with single sign-on (OAuth 2.0 / OpenID Connect).
Multi-factor authentication enforced at your identity provider.
Production access limited to named engineers, with MFA and quarterly review. Leavers lose access within 24 hours.

Tenant isolation

Each customer’s data is logically isolated. Nothing is shared across accounts.
Permissions are enforced in the application. Matter-level roles are in development.
Timestamped audit records trace every output back to its source documents.

AI models and your data

Claude (Anthropic) via the Anthropic API under a zero-data-retention agreement: prompts, documents and outputs are processed in memory and not stored by the provider.
Answers are grounded in your documents and the rulebook through retrieval, not fine-tuning.
Every suggestion shows its source and regulatory basis. Your lawyers keep control.

Retention and deletion

Users and administrators can request deletion at any time.
On termination, we delete customer data and confirm deletion in writing.
Deletion is carried out on request today; retention settings can be agreed per engagement.

Operations

Microsoft Defender for Cloud and Azure Monitor alert engineering to threats and anomalies.
Dependency and container scanning in CI/CD. Every production change goes through peer-reviewed pull requests.
Continuous backups with point-in-time restore and geo-redundant storage. Cyber insurance in place.

Deployment

Three ways to deploy, from fastest to most isolated.

Managed SaaS

Hosted by Finiti on Microsoft Azure.

Fastest to start; Finiti runs updates, monitoring and incident response.
Frontier models under zero-data-retention terms.
Not suited where data legally cannot leave a jurisdiction.

Your cloud tenant

Finiti deployed in your own cloud subscription and region.

Documents stay inside your boundary; Finiti manages the application.
Only the model request leaves your tenant, under zero-data-retention terms.
Each sub-processor is subject to your approval.

On-premises

The full stack on your infrastructure, air-gapped if required.

No third-party sub-processors.
Runs open-weight models locally, which are less capable than frontier models.
Requires GPU-capable servers; updates arrive as versioned packages.

Sub-processors

Who processes data for the managed service.

On-premises deployments use none of these. We give customers at least ten business days’ notice before adding or replacing a sub-processor.

Provider	Purpose
Anthropic	Large language model inference, under a zero-data-retention agreement
Microsoft Azure	Cloud infrastructure and storage
Qdrant	Vector search
Reducto	Document parsing
Exa	Web search for non-filing sources, with zero retention of search queries
Datamule	SEC EDGAR filing retrieval
PostHog	Product analytics (anonymised telemetry only)
Pydantic Logfire	Observability

Request documents

Running a security review?

Tell us what your security team needs. We send the documents, and answer your questionnaire if you have one.