Scope: Individual dashboard data, documents, extracted text, private storage and conversations; institutional AI conversation ownership. This public page contains no customer documents, account identifiers or financial records.
CC6 · Personal account boundary
Individual documents, extracted pages, conversations and messages carry the owner's user identifier. Row-level policies compare it with the authenticated caller for reads and writes. A second account receives its own dashboard, not the first account's data.
C1 · Private document storage
Individual files are stored in a private bucket beneath an account-owned folder. Storage policies check that first folder against the caller. Listing, downloading and uploading outside that folder must be denied.
CC6 · Product separation
Individual data uses separate records and storage from institutional deal rooms. Individual signup grants no firm membership, investor access or waiting-list management privilege.
CC6 · Institutional AI privacy
Firm-wide conversations require both organization membership and personal ownership. Answers are private to their author, including against another member of the same firm. Message ownership and organization must match the parent conversation.
PI1 · Authenticated AI processing
AI actions validate the caller, validate input and query with that caller's access policies. Exact quotes are checked against accessible source pages. A matched quote proves source correspondence, not financial accuracy or independent verification.
C1 · Deletion and retention
Individual users can delete their documents and conversations in Settings. Firm-level retention schedules apply to institutional documents; they are not evidence of an Individual automatic-retention schedule.
Auditor evidence index
What the auditor should examine
- Current row-level policies, grants and private-storage configuration, including parent-record ownership checks.
- A dated two-account test report: owner positive controls, foreign-account reads and writes, storage denial and unchanged owner records after attempted writes.
- Signed-in UI checks: the second account's dashboard and documents are empty of owner data; a direct private conversation link exposes no owner answer.
- Authenticated action tests rejecting another account's document and conversation identifiers before AI processing.
- Evidence limitations: a point-in-time test is not continuous monitoring, penetration testing, provider-control verification or an independent audit opinion.
Detailed test evidence is supplied privately to the engaged auditor. Test results should be re-run after access-policy changes.