Security and confidentiality for transfer pricing files

Zero Data Retention on LLM API calls

Generation can run on Anthropic Claude with automatic fail-over to OpenAI. Those calls use Zero Data Retention: prompts and document content are not stored by the model provider. That is a retention posture at the vendor API, not a claim that no processor ever sees a prompt.

What the model is not allowed to own

AI drafts narrative prose. Tables, statutory citations, quartile math, and the arm's length range are computed in code. Translated Local Files localise numbers deterministically. A digit-integrity check rejects any fragment whose digit sequence drifted. Entity legal names, citation numbers, database names, and currency codes are never translated. Instant PLI classification rules override the model for known line items, and every override is audit-trailed.

Access control and tenancy

Workspaces are multi-tenant, with consultancy scoping, four roles, and per-report collaborators. Storage is access-controlled with SSL/TLS. Each client's data is kept separate. Admins can edit prompt templates without a developer ticket, which is a control surface: limit who can change house language.

PDF toolkit: files that never leave the browser

Merge, split, extract, rotate, reorder, and compress run in a local Web Worker. Those PDF operations never upload the file. Report generation is a different path: it does use our infrastructure. We will not collapse those two into one slogan.

What this page does not claim

We do not list SOC 2 or ISO 27001 as product certifications here. We do not claim that client financials are used to train a public model. We do not claim in-browser processing for the whole platform. If your IT questionnaire needs a region, subprocessors list, or deletion workflow, ask on the walkthrough or read the privacy policy.

The four controls we already publish

Related: methodology, the confidentiality article, about SBC.