Security & trust

Every firm's data sits in its own namespace behind deny-by-default database rules. A request for another firm's data is refused at the data layer, so a bug in the application cannot open a door the rules keep shut. File storage is scoped the same way, and that boundary is tested — a second firm requesting another's files is refused.

Each firm holds its own securities catalogue, prices, FX rates, fee rules and reference data. There is no shared pool a neighbouring firm could read from or accidentally write into.

Firms that need physical rather than logical separation can be provisioned onto their own isolated cloud project. Available as an enterprise option.

Client-side code is denied write access to transactions outright. Every ledger movement goes through server-side functions that independently re-derive and validate the numbers before committing them — so what lands in the book never depends on what a browser claimed.

Money-moving actions route maker → checker, and checkers can be restricted to the specific categories of action they're allowed to approve. A firm operating solo self-approves, and every self-approval is written to the audit trail.

Nothing is edited in place. A correction is a reversing entry — in the portfolio ledger and the general ledger alike — so the original record and the correction both survive, with the reason attached.

A struck NAV is write-once and gated behind readiness checks. It is the official record your statements stand on, and it cannot be quietly restated — a change to a locked period produces a documented, bundled restatement.

Sign-ins, approvals, policy overrides, fee posts, reversals and administrative changes all land in one searchable audit log.

Role-based access with per-user restriction of individual screens and per-checker restriction of approvable actions. Relationship managers can be confined to their own book, enforced by the database rules rather than by hiding menu items.

Idle sessions time out. The platform operator console additionally demands a fresh password before it will open, re-prompts every 30 minutes of continuous use, and signs the operator out after 15 minutes of inactivity.

App Check with reCAPTCHA attests that requests come from our real application in a real browser before the backend will answer them.

646 automated tests across 30 suites cover the money-critical logic — fee computation, margin, NAV, accounting, corrections — and run before code is committed, alongside structural checks on the database rules.

The platform went through a structured security review in July 2026 covering authentication, tenant isolation, injection, rate limiting and the money path. Every finding rated high or above was fixed before this page was published, including a fail-safe change so that a missing exchange rate now forces manual review instead of passing silently.

Data is encrypted in transit over HTTPS and at rest by our infrastructure provider. Statement PDFs can be password-protected before they leave the platform.

It answers questions against your firm's own records only, through a fixed set of read-only queries. It is scoped to your firm, restricted to authorised roles (typically GM, operations, compliance and checkers), rate-limited, and metered per firm. It cannot write to the ledger, move money, or reach another firm's data.

The feature runs server-side, never in the browser. To answer a question, the query and the specific records needed to answer it are sent to Anthropic's Claude API, our model provider, which processes them in the United States. No separate copy of your book is uploaded, and the model is not trained on your data.

The AI layer is for exploration and drafting. Every formal number — valuations, NAV, fees, statements, regulatory returns — is produced by the deterministic reporting engine, not by a model. If the two ever disagree, the report is right.

The feature is tied to plan entitlement and can be disabled for your firm entirely.

The full database is backed up automatically every night. A failed backup raises an alert to our operations address the same night rather than failing quietly.

A scheduled probe checks the platform every few minutes and sweeps each firm hourly; degraded scheduled jobs and delivery failures raise alerts.

If we become aware of a breach affecting a firm's data, we will investigate immediately, contain it, and notify the affected firm without undue delay with what we know, what we've done, and what we recommend — so the firm can meet its own regulatory notification duties. Report a suspected issue to hello@zetmos.com; we won't pursue anyone who reports one in good faith.