SECTION ISecurity Overview

FinHelm Corp builds Probabilistic Finance™ products on a no-ledger-copy architecture: raw financial data from connected ERP systems is fetched live, processed for the requested analysis, and discarded, never warehoused. FinHelm stores what customers author in the product (budgets, driver sets, scenarios), forecast history, account and billing records, encrypted connection credentials, and audit metadata. This architecture materially reduces the data-exposure surface relative to traditional FP&A platforms that ingest and store full ledger copies.

FIG. I.a · The ledger boundary is structural, not procedural. The ledger we never store, we cannot lose.

SECTION IIArchitecture

• Cloud: Amazon Web Services, U.S. East (Northern Virginia) region (us-east-1) only for v1.1.
• Compute: Vercel Edge runtime serving the MCP layer; AWS Lambda (serverless; no persistent application servers) for analysis engine compute at api.finhelm.ai.
• Data store: Amazon DynamoDB for analysis outputs, authentication state, and OAuth tokens. Encrypted at rest using AWS Key Management Service customer-managed keys.
• Networking: Amazon API Gateway (HTTPS only); TLS 1.2 minimum.
• Frontend: Vercel (Next.js).
• Integration: FinHelm connects to ERP providers via the Model Context Protocol over authenticated HTTPS.

SECTION IIIAuthentication

• Identity: AWS Cognito user pool. People sign in through a first-party FinHelm form served over TLS; FinHelm passes the credentials to Cognito and never stores the password.
• Connecting applications: OAuth 2.0 authorization code flow with PKCE, against the FinHelm authorization server.
• Bearer tokens: Short-lived; refreshed via standard OAuth refresh-token flow; revoked immediately on disconnection or account closure.
• ERP authentication: OAuth 2.0 authorization code flow against the ERP provider. FinHelm never sees or stores ERP passwords.

SECTION IVData Encryption

• In transit: TLS 1.2 or higher on all customer-facing endpoints.
• At rest: AES-256 via AWS KMS customer-managed keys. Token table is encrypted with a dedicated CMK with annual rotation enabled.
• Browser exposure: OAuth tokens and ERP credentials are never transmitted to the browser. They are stored server-side and used only by FinHelm’s backend.

SECTION VAccess Control

• Principle of least privilege: All IAM roles are scoped to the minimum permissions required for the function they perform.
• Token-table access: Restricted to a single dedicated IAM principal scoped via a least-privilege policy.
• Audit logging: Authentication events, ERP connection events, MCP tool invocations (tool name, account identifier, timestamp, status code), and administrative actions are logged. Tool-call parameters and response bodies are not logged.
• Production access: Restricted to authorized FinHelm engineering personnel with named accounts and audited access.

SECTION VICompliance Posture

• SOC 2 Type I: In progress.
• SOC 2 Type II: Planned to follow Type I.
• HIPAA: Not applicable. FinHelm does not process protected health information.
• PCI DSS scope: Zero. All payment processing is handled entirely by Stripe; FinHelm does not receive, store, or transmit primary account numbers.
• GDPR / CCPA: Customer rights (access, correction, deletion, export) are honored as described in the FinHelm Privacy Policy.

FIG. VI.a · FinHelm makes no representations regarding compliance certifications it has not earned. Aspirational items above are explicitly marked.

SECTION VIISub-Processors

PostHog: Product analytics is on by default on selected website and product pages unless you have declined it or enabled Do Not Track or Global Privacy Control. We collect visits, clicks, form change or submit actions without entered values, scrolling, page time and exits, and heatmaps. Visitor profiles include browser/device details and user-agent strings, IP address, approximate location and visit sources. After a confirmed contact or assessment submission with analytics allowed, we link visits to the submitted email and available contact and company details. Verified sign-ins with analytics allowed use stable account identifiers. Server tracking records confirmed lead saves, account visits, billing and email delivery outcomes, sanitized errors and tool-call timings. Saved lead and account choices control later linked server events.

Session replay is enabled for all eligible sessions. Recordings include page layout, public text and interactions, with all form values masked. Text in signed-in product pages and financial or user-content areas of the assessment is masked; embedded frames, canvases and designated private visualizations are blocked. Sign-in and other excluded pages, financial inputs and results, ledger data, message bodies, payment credentials, passwords, sign-in tokens, console logs and network request or response contents are excluded. Tool diagnostics exclude prompts, arguments and results. Use Privacy choices to allow or decline analytics and recording. Your saved browser choice remains until you change it or clear browser storage. Clearing browser storage removes the local choice, while a saved account decline can apply again at sign-in. Separately, limited public-request delivery records use hashed client identifiers without person profiles and exclude private routes, queries, bodies and runtime messages. See the Privacy Policy, Section IV for details.

Google Analytics: Analytics is enabled by default on selected public marketing pages, using the same Privacy choices and browser privacy signals. Assessment, account and sign-in pages are excluded. We send predefined page names and confirmed contact submissions, with a limited product-tier category. Google may also process browser/device information, session activity and approximate location. Its first-party identifier cookies are configured to expire after 180 days without refreshing that period on a visit. Form contents, financial values, account identifiers, raw query strings and referring URLs are excluded; advertising features and automatic form, search and click measurement are disabled. See the Privacy Policy, Section IV.

FIG. VII.a · The canonical sub-processor list is maintained at finhelm.ai/privacy/.

SECTION VIIIData Residency

• v1.1: All customer data, tokens, and analysis outputs are stored in AWS us-east-1 (Northern Virginia, USA).
• v1.2 and later: International data residency options (EU, UK, APAC) are planned and will be announced before any non-U.S. region is offered.

SECTION IXBreach Notification

In the event of a confirmed security incident affecting customer data, FinHelm will notify affected customers without undue delay and in any case within seventy-two (72) hours of confirmation, consistent with prevailing standards under GDPR and U.S. state breach-notification laws. Notification will identify, to the extent then known, the nature of the incident, the data affected, mitigation steps taken, and a point of contact.

SECTION XCustomer Rights

• Data export: Analysis history is exportable in standard formats from your account.
• Account deletion: request-based. Email privacy@finhelm.ai from your account email; deletion completes within 30 days of a verified request. Timelines are described in the Privacy Policy.
• ERP disconnection: One-click revocation. Tokens are deleted within 24 hours of disconnection.
• Data subject requests (GDPR/CCPA): privacy@finhelm.ai.

SECTION XIContact

• Security inquiries and disclosures: privacy@finhelm.ai
• Privacy inquiries: privacy@finhelm.ai
• General support: support@finhelm.ai

FinHelm Corp · finhelm.ai

Probabilistic Finance™ · Always On Course.