Your Sensitive Data,
Under Your Control
The confidential records you cannot afford to lose control of - client files, financial records, governance documents, the correspondence around them. FinPera keeps them in one place, with you deciding who sees what.
Whatever you keep with us, the protections are the same
Professional firms
Client files and engagement records, working papers and deliverables, filings and compliance calendars, and the correspondence around every client you act for.
Companies
Ownership and governance records, statutory filings, financial reporting, and the documents you share with your board, your advisers and your investors.
Nothing in your workspace is shared with another customer unless someone in your organisation shares it.
The Problem with How Things Work Today
Without FinPera
Sensitive files shared over email
Client files, financial records and board documents sent as attachments
Files easily forwarded
No way to prevent recipients from sharing further
No visibility into access
Who opened it? Who passed it on? There is no way to tell
Version chaos
"...v3_FINAL_v2_updated.xlsx" - which one is the real one?
Knowledge walks out the door
When team members leave, context and history go with them
With FinPera
Secure, centralized platform
One place for all sensitive information
You control who sees what
Grant access to specific people, revoke anytime
See who has access
Every share is listed, so you can see who has access to what and withdraw it.
Single source of truth
Always the latest version, no more file chaos
Institutional knowledge
Everything documented, nothing lost when people leave
Without FinPera
With FinPera
Sensitive files shared over email
Client files, financial records and board documents sent as attachments
Secure, centralized platform
One place for all sensitive information
Files easily forwarded
No way to prevent recipients from sharing further
You control who sees what
Grant access to specific people, revoke anytime
No visibility into access
Who opened it? Who passed it on? There is no way to tell
See who has access
Every share is listed, so you can see who has access to what and withdraw it.
Version chaos
"...v3_FINAL_v2_updated.xlsx" - which one is the real one?
Single source of truth
Always the latest version, no more file chaos
Knowledge walks out the door
When team members leave, context and history go with them
Institutional knowledge
Everything documented, nothing lost when people leave
How We Protect Your Data
Encryption, access control and a published list of the providers we rely on, built for financial and governance data.
Encrypted in transit and at rest
Data is encrypted in transit over TLS and encrypted at rest by our hosting and storage providers.
You control access
Decide exactly who sees what - a colleague, a client, an investor, an adviser. Grant view-only or edit, and revoke it the moment you need to.
Secure sign-in
Sign in with Google or Microsoft, and turn on an extra verification step for added security. Single sign-on through your own identity provider is set up on request for larger teams.
You can see who we rely on
Every third party that processes your data is named, with what it does and where it sits, on our sub-processors page.
Our AI Works for You, Not on You
Clear rules about how our AI handles your information.
Not used to train models
We do not use your content to train AI models, and we do not authorise our AI providers to train on it, unless you agree otherwise in writing.
Sensitive identifiers have their own fields
Enter Social Security numbers and similar identifiers only in the fields designed for them, where they are encrypted and masked. Recognised identifiers of this kind are removed from text before it is sent to any AI provider.
AI runs across your workspace
To produce results, AI reads and re-processes what is in your workspace, including in the background. Our AI Processing Notice sets out exactly what that involves.
AI suggests, you decide
A human stays in the loop: AI drafts and suggests. Posting an entry, sending a message or changing a record is left to a person, or to an automation your team has set up.
Where we stand on certifications
We are preparing for an independent SOC 2 examination against the Security criteria. Security documentation can be shared with customers and prospective customers under a confidentiality agreement - ask us. Our practices are also designed to support the GDPR and India's Digital Personal Data Protection Act, 2023.
Access and where your data lives
- Multi-factor authentication is available on every account at no extra cost, using an authenticator app, and we recommend every user turns it on.
- Data is encrypted in transit and at rest. Documents are held in private storage and are released through short-lived, individually generated links.
- Access to workspace data is checked against the requesting user's organisation and permissions, and we are progressively adding the same restriction at the database layer.
- Our application and database run in United States regions. Uploaded documents are held with a global storage provider. Every third party involved, what it does and where it holds data is listed on the sub-processors page.
- For readers in India: Section 16 of India's Digital Personal Data Protection Act, 2023 allows the Government to restrict transfers of personal data to countries it notifies. The United States is not a restricted country, so personal data of people in India may be processed there.
How changes reach production
Every change to FinPera passes automated checks before it can be released: type safety and automated tests, scanning for exposed secrets, dependency vulnerability checks, static security analysis and tenant-isolation tests. Production releases are not automatic - a release is only made once those checks have passed for that exact version of the code. Access to production systems is limited to a small number of named people, with multi-factor authentication.
This page describes our security practices in general terms. It is for information only, is not a warranty, and may change. Our commitments to customers are those in our Terms of Service and Data Processing Agreement.
Found a Security Issue?
We take security seriously. If you discover a vulnerability, please let us know responsibly.
Submit it through our legal, data and privacy request form and choose Report a security issue as the request type. You get a tracked reference, and it reaches our team directly rather than sitting in a shared inbox.
We aim to acknowledge reports within two business days and will keep you updated as we investigate. Please give us a reasonable period to remediate before any public disclosure, and do not access, modify, or exfiltrate data belonging to other users while testing.