Data and AI Practices

Advisors trust us with the most sensitive thing a practice has: how it works. This page explains, in plain language, exactly what data Wallace Understudy touches, where it goes, what never leaves your machine, and the terms under which any of it reaches an AI model. It is the short, readable companion to our Privacy Policy, Terms of Service, and Data Protection and Security Addendum. Where they differ, those documents control.

The short version

• Raw client data never leaves your machine. Client files are read and analyzed entirely in your browser. Only de-identified patterns are saved, and the key that would link those patterns back to your clients is generated and kept only on your device. We cannot reach it.
• Meeting transcripts are scrubbed before they leave your computer. Names, account identifiers, and balances are replaced on your own device. The transcript itself is never stored by us.
• No AI model is trained on your data. We call the AI through Anthropic's and OpenAI's commercial APIs, whose terms do not allow training models on customer content. We do not train anything on it either, in any form.
• Your playbook belongs to you. Download your playbook as a PDF on Digital Twin and above, erase it any time, cancel any time. We never sell your firm's data, never use or share it for advertising, and never use one firm's data to benefit another.

Client data: read in your browser, never uploaded

When you upload CRM exports, custodian files, or other client data files, those files are parsed by code running in your own browser. The raw files are never transmitted to our servers. What leaves your machine is a set of de-identified patterns: each household and account becomes a code, dollar values become ranges, and dates are reduced to months. No names, no email addresses, no account numbers.

If a file arrives in a layout the software does not recognize, it asks you to map the columns once and remembers that mapping for your whole practice. To suggest a mapping, the column headings alone may be sent to the AI. The cell contents are not.

The key that links codes back to your clients is stored only on your device. We could not identify a client from the data we hold even if we wanted to. This is an architectural property, not a policy promise: the identifying information is never in our possession. We say "de-identified" rather than "anonymized" on purpose, because a key does exist; it just exists only with you.

Meetings and calls: pseudonymized on your computer

You can bring in transcripts from any notetaker, as a file or by pasting. Before anything leaves your computer, names, account identifiers, and balances are replaced. The pseudonymized text is used to distill candidate method statements, which the interview asks you to confirm or reject. Statements you do not confirm never compile into your playbook. The transcript itself is never stored anywhere on our systems.

Nothing from a transcript is retained except the statements you confirmed. The transcript itself is never stored, on any tier.

Firm documents: stored, because that is their job

Firm documents are different from client data, and we treat the difference honestly. When you upload SOPs, policy manuals, or procedure documents, they are distilled on our servers into quotable policy items, and those items and the underlying document are stored with your account. That is what makes the product useful: the twin quotes your documents back word for word, with receipts pointing at the exact section and sentence.

Firm documents describe how your firm works, not who your clients are. We tell you to keep client files out of that section, and the client data pipeline described above remains browser-only regardless. You can see exactly what was extracted from each document, exclude any item, and delete any stored document at any time.

What the AI actually sees

Wallace Understudy uses two AI providers, each through its commercial API. Claude, a model built by Anthropic, compiles your playbook, runs the interview, answers questions, and grades checks. OpenAI models do two narrower jobs on the firm documents you chose to store: they read each document and distill it into the quotable items your playbook is built from, and they turn each passage into the numerical index that lets a question find the passages that answer it. Between them, the AI receives these kinds of material, and only these: the de-identified patterns described above, the policy items and text of firm documents you chose to store, pseudonymized meeting content, your interview answers, and the questions typed into Ask. OpenAI receives only the stored document text and, for search, the question. Neither provider ever receives raw client files, client names, account numbers, unscrubbed transcripts, or the key linking codes to clients, because none of those ever reach our servers in the first place.

Every answer the twin gives cites the confirmed rule or document it came from. When your playbook does not cover a topic, the twin says so rather than inventing an answer, and a team member can route the question to you in one click.

The AI providers' obligations

We access Claude exclusively through Anthropic's commercial API, which is governed by Anthropic's Commercial Terms of Service. Three facts about that arrangement matter to advisors:

• No training. Under the Commercial Terms, Anthropic may not train models on customer content. Data sent through the API is not used to improve or train any AI model. This is the default for commercial API customers, not an opt-out we had to configure.
• Limited retention. Anthropic's standard API retention is short and is held for trust and safety screening, then deleted. It is not retained for training under any circumstances. The current retention period is stated in Anthropic's published terms.
• Output ownership. The Commercial Terms assign ownership of outputs to the customer. Your compiled playbook is yours.

We access OpenAI's models through its API under OpenAI's business terms: data sent through the API is not used to train or improve OpenAI models, and it is kept for up to thirty days for abuse monitoring, then deleted. These statements describe both providers' published terms as of September 2026. We monitor them and will update this page if they change.

Sources you choose

Your enabled sources add clearly labeled, cited context to answers in Ask, drawn from a Wallace-vetted catalog of regulators, government programs and data, planning research, and licensed publishers. Live sources are searched through a server-enforced allowlist, and we do not store the text of the pages retrieved, other than verbatim excerpts of public government materials kept inside the product. Every claim is cited to a named source, commentary is labeled as commentary, and when your sources do not cover a question the twin says so instead of falling back to the open web or the model's general knowledge. Only the advisor can enable or disable a source, every seat can see the list, and every change records who made it and when. Citing a source is not an endorsement of it, and nothing in the product implies that a regulator has reviewed or approved the software or your practice.

Where your data lives

Your account data, compiled playbook, stored firm documents, and de-identified patterns live in a dedicated PostgreSQL database hosted by Supabase, protected by row-level security policies that scope every record to your firm. One firm's data is never readable by another. Sign-in is by a password you set or a single-use link sent to your email; passwords are held only as salted hashes by our authentication provider, and we never see them. The application is hosted on Vercel, and the service that reads and indexes your stored firm documents runs on Amazon Web Services. All traffic is encrypted in transit with TLS. Transactional email, such as sign-in links, invitations, and the weekly digest, is delivered through Resend. Billing is handled by Stripe; we never see or store full card numbers. All processing and storage is in the United States.

Our subprocessors are: Anthropic (AI processing), OpenAI (document distillation and the search index), Amazon Web Services (the service that reads and indexes stored documents), Supabase (database hosting and authentication), Vercel (application hosting), Resend (transactional email), and Stripe (billing). The current list, and our commitment to give notice before adding to it, is in Exhibit B of the Data Protection and Security Addendum. We do not sell your firm's data to anyone, share it with advertisers, or grant any third party access to it beyond these named processors. Our marketing website, which is separate from the product, uses Google Analytics and the LinkedIn Insight Tag, as described in the Privacy Policy.

Chats and retention

Saved chats are kept for thirty days so you can pick up where you left off, then expire. Your playbook, its version history, confirmed statements, stored documents, and de-identified patterns are kept for as long as you subscribe. Questions routed to the advisor are shown to the advisor without the name of the person who asked.

Access, roles, and the record of authorship

Each firm controls its own seats. Your tier includes a set number of team seats, and you can invite and remove people at any time. Team members can ask the twin questions, take checks, follow their Day One track, and route questions to you; they cannot upload client data, change sources, or alter the playbook. A named continuity partner can be granted time-boxed access to a playbook for continuity purposes, and every activation, its reason, who opened it, and when it expires are recorded.

The playbook carries a full record of where each rule came from: observed in data, said in an interview, confirmed from a meeting, or extracted from a document. Your item-level sign-offs, rulings on conflicts and drift, and interview answers are the signature; there is no separate attestation step. Every change produces a new version, and superseded versions stay in the ledger. If you mark a statement "not my methodology," it is removed and never re-learned, even if it is phrased differently next time.

Deletion and portability

From Settings you can download your playbook as a PDF on the tiers that include it and erase all twin content. You can delete stored firm documents yourself from the Documents and meetings page. If you cancel, your content stays readable for ninety days, with an export available on request, and then we delete your firm's records and confirm in writing on request.

What this page is not

This page describes how we handle data. It is not legal advice, and Wallace Understudy is not a compliance program: the product documents and validates how closely your practice follows its own stated process, and your compliance obligations remain governed by your own policies and counsel. Validation asks whether a captured rule is still right; it is not an employment, performance, or compliance metric, and our Terms prohibit using it as one. Where we describe another company's terms, such as Anthropic's or OpenAI's, we are summarizing their published commitments, which those companies control. Wallace Finance Co. is an SEC-registered investment adviser; that registration does not mean the SEC or any other agency has reviewed or approved this software.

Questions

Ask us anything about this page at support@wallacefinance.io. If your compliance officer wants to walk through it on a call, we are glad to. The same page is also available inside the product at app.wallaceunderstudy.io/trust.