Security and privacy
We read a business’s most sensitive records. We act like it.
Here is exactly what we commit to, in plain language.
- Read-only by design
- Connections request read-only access. Inherit never sends email, edits the books, changes jobs or moves money.
- Consent from both sides
- Buyer and seller each sign a capture consent naming every source, and nothing outside it is read. The seller can see exactly what was read, and remove anything personal.
- Exclusions you control
- Leave out any email label, contact or person, such as an employee. Either side can add to the list. Matching records are never read, or deleted if they already were.
- Never used to train AI
- The business’s data is not used to train Inherit’s or any provider’s AI models.
- Encrypted everywhere
- TLS in transit. The business’s records, and the logins used to read them, are encrypted at rest with AES-256 and scoped to a single workspace.
- Delete anytime
- Disconnect a source and its records are deleted, along with anything drafted only from them. Close a workspace and everything is removed within 30 days, or delete it at once.
- Least-privilege sharing
- Lenders and brokers see readiness metrics only, never source documents, and only with the buyer’s consent.
- Audit trail
- Every connection, sync, answer, question, export and deletion is logged with who did it and when. The buyer can download it at any time.
Compliance status
SOC 2 Type I audit in preparation. Recording laws differ by state, so call transcripts are only read where every party consented to recording, and our consent templates cover two-party-consent states.