Security and trust
Your investors see the memo. Here is what protects the data behind it.
Acquiror AI stores your data at rest in Canada, authenticates through Microsoft Entra, scopes every data access path to your organization, and publishes its subprocessors, its retention schedule and its uptime commitment. This page also sets out where things stand today.
Where your data lives
| Data | Where |
|---|---|
| Deals, financials, QoE, valuations, decisions, memos, audit logs | Canada |
| Uploaded documents | Canada |
| Document search index | Canada |
| Secrets, including your bring-your-own AI key | Canada |
| Sign-in identity | Global (Microsoft sign-in service) |
| Billing and card data | United States (Stripe) |
| Platform AI inference | United States; see Where AI processing runs below |
Not everything runs in Canada. Platform AI processing (see Where AI processing runs below), transactional email and the delivery of the web application to your browser happen in the United States, sign-in runs on a global Microsoft service, and card payments are processed by Stripe in the United States, as the Subprocessors page lists.
Data in transit is protected by TLS. Data at rest is encrypted by the platform.
Identity and access
- Sign-in through Microsoft Entra External ID. Acquiror AI never stores a password.
- Roles. Admin, plus four member permissions: Editor (full contributor), Read Only (view, never modify), QoE Reviewer (Editor plus the cross-deal review queue) and Auditor (view and export for audit, never modify deal content). Only admins manage members, billing, valuation rules, financing thresholds, AI settings and data export.
- Business email only. When enabled, the email-domain policy blocks free, consumer and disposable email domains from signup and invites.
- MCP connectors sign in with the same identity through OAuth. An assistant holds a token for the user; there is no shared API secret to leak.
Tenant isolation
Every organization is a tenant, and its data is isolated logically: every data access path is scoped by the organization's identifier, enforced in the application and data access layers, not by convention in the user interface. Changes that touch authentication, tenant scoping, data migrations or financial calculations receive an additional security-focused review before they merge. Documents, search and exports are scoped to the organization. The MCP server enforces the same isolation on every tool call.
Where AI processing runs
- Platform AI (Vera): inference runs today in the United States, on a deployment type under which an individual request may be processed in any region where the model is available. Our AI provider's terms commit that prompts and outputs are not used to train or improve models, and that data at rest stays in the designated geography. What crosses the border is the inference request: the document text being indexed, or the passages, the question and the deal data the feature requires. Nothing is removed from a prompt automatically. Moving AI inference to Canada is on the roadmap; until it ships, treat platform AI processing as occurring outside Canada.
- Bring your own key: choose OpenAI or Anthropic and your own agreement with them governs. Your key is written once to a secure key vault and referenced from then on; it is never stored in the database and never displayed again. If you ask the product to list the available models before you save a key, the key is sent once for that listing and held only in memory. Gateways must be public https addresses.
- Your data stays out of training, either way. Acquiror AI does not train models on customer data.
Availability
- 99.5% monthly uptime commitment for paid subscriptions, with service credits of 5% to 25% of the monthly fee when it is missed. Published in the SLA.
- Separate staging and production environments; releases are tagged and deployed through a pipeline with manual approval for production.
- Backups and deletion-recovery windows protect against accidental loss.
Your data is yours
- Export any time. Admins export the whole organization as a ZIP bundle: structured JSON for every record (deals, QoE, normalized statements, valuation, revenue durability, memos, contacts), the original uploaded document binaries, and a manifest listing what is and is not included. A pre-flight summary shows the counts first, and every export is logged. Per deal, the decision chain exports to PDF, Excel or JSON, the memo to PDF, and financing to a credit memo PDF.
- After cancellation: access, including the self-service export, to the end of the paid period; for 60 days after that, an export of your data on request; then deletion within 90 days after that window.
- Retention is published. How long each kind of record is kept, and when it is deleted, is in the Data Retention Schedule.
- You are told what happens. Transactional email covers team invites, trial ending, payment failed, card expiring, upcoming invoice, a bank's authentication request on a payment, and a decision export being ready.
Billing security
Stripe processes every payment. Card numbers never reach Acquiror AI's systems. Invoices, payment methods and history are managed in Stripe's billing portal from the app. Sales tax is calculated by Stripe at checkout.
Where things stand today
The answers a security questionnaire asks for, before it asks.
- No SOC 2 or ISO 27001 report. We will publish when we have one.
- No customer-selectable data region. Data at rest is in Canada; AI processing, transactional email and web delivery are in the United States, as Where your data lives above and the Subprocessors page list.
- No public API. MCP is the integration surface.
- No per-document permissions inside an organization; roles apply across the workspace.
- Platform AI inference is not yet in Canada (see Where AI processing runs above).
Request the security overview
Use the contact form and select "Security review".