Security and data
Where data is held
Client records and files are stored in a Supabase Postgres database and Supabase file storage in its London region (eu-west-2). The application is hosted by Netlify, with its server functions also running in London.
Data is encrypted in transit between the browser and the application and between the application and the database, and encrypted at rest by Supabase.
Each firm's data is kept apart
Every table carries the firm a record belongs to, and row-level security in the database limits each member of staff to their own firm's rows. The rule is applied by the database to every query, whichever screen or function makes it.
We test it by signing in as staff of two different firms, as a non-staff user and with no sign-in at all, and checking that none of them can read or change another firm's records. The checks are run again whenever a security rule changes.
Roles and sign-off
Each member of staff has one or more roles: adviser, paraplanner, administrator or compliance. The database enforces what each role can do.
- Only a compliance user can approve a case or return it with notes.
- An adviser cannot approve their own case unless the firm has chosen to allow it.
- A suitability report, fee agreement or application cannot be sent for signature until the case is approved.
- Only an adviser or compliance user can approve an AI draft, and a document built from a draft cannot be sent until the draft is approved.
How clients sign in
Clients open the portal from a link their adviser sends, then enter a six-digit code sent to the email address the firm holds for them. A code lasts ten minutes and allows five attempts, and codes are stored only in hashed form. Clients do not have passwords.
A portal session opens one household's portal only. Each person in a couple signs their own documents.
Records of who did what
Each case keeps a log of stage changes, holds and compliance decisions, with the person and the time. Each AI draft keeps a record of when it was requested, generated, edited and approved, and by whom; the database writes that record itself, so it cannot be skipped. Each signature records the signer's typed name, the time and a SHA-256 fingerprint of the document they signed.
AI drafting and client data
The AI drafting tools are part of the Complete plan. When a member of staff asks for a draft, the relevant part of the client's file is sent to Anthropic's API to produce it. Firms on Core send no client data to Anthropic.
Companies that process data
- Supabase: database and file storage, London region.
- Netlify: hosting the application, with its server functions in London.
- Anthropic: the AI drafting tools on the Complete plan.
Data processing agreement
Your firm is the controller of its clients' data and Chivvy Ltd processes it on your behalf. We provide a data processing agreement on request: andy@chivvy.co.uk.