Security posture and compliance readiness for enterprise review
This page provides an overview of our data protection practices, access controls, audit capabilities, and AI governance posture. Designed to support enterprise security reviews and procurement evaluation.
FinanceModel is currently working toward formal security certifications (SOC 2 Type II). We do not yet hold these certifications. The information below describes our current security controls and practices. For specific compliance requirements, please contact our team.
How we protect your data at rest and in transit
Data at rest encryption
AES-256 encryption for stored data
Data in transit encryption
TLS 1.3 for all network traffic
Key management
Provider-managed encryption keys with rotation
Tenant isolation
Logical data separation per organization
Row-level security (RLS)
Database-enforced access boundaries
Environment separation
Production isolated from development
Data residency
Data stored in secure cloud infrastructure
Backup & recovery
Regular encrypted backups with retention
Data portability
Full export capability at any time
How we manage authentication and authorization
Secure user authentication with email/password and social providers
Role-based access control (RBAC) at organization and model level
Secure session handling with configurable timeout
Logging, version history, and audit capabilities
| Capability | Description | Evidence |
|---|---|---|
| User Activity Logging | Comprehensive logs of user actions within the platform | Audit trail accessible via UI |
| Model Change History | Complete version history of all model changes | Version snapshots with timestamps |
| Access Logging | Logs of who accessed what data and when | API and application logs |
| AI Interaction Logging | Record of Finny assistant interactions | Conversation history per model |
Audit logs are accessible to organization administrators. For detailed audit requirements, please contact our team.
How we handle AI assistance responsibly
Standards we are aligned with or working toward
Note: "Aligned" means our practices are designed to support these standards. It does not mean we are certified. "In Progress" means we are actively working toward formal certification.
Working toward formal certification. Controls designed with SOC 2 Trust Service Criteria in mind.
Information security management practices aligned with ISO 27001 principles.
Data handling practices designed for GDPR compliance. Data portability and deletion supported.
California privacy requirements supported through data access and deletion capabilities.
To provide accurate expectations, here is what is currently out of scope or not yet available:
We maintain transparency about our compliance posture. Material changes to security controls or compliance status will be communicated through:
Last updated: January 1, 2026
Our team can provide additional documentation and answer specific security questions for your evaluation process.