Security
Secure bymandate.
Security, privacy and control for the most confidential work in finance.
Data protection
Siloed storage
Your firm’s data sits in an environment of its own, isolated from every other Pitchcrow customer.
Encrypted at rest and in transit
AES-256 encryption at rest and TLS 1.2+ in transit, the same standard the institutions we serve run on.
Deployed to your infrastructure
If your policies require it, Pitchcrow runs with no shared resources, up to and including inside your own infrastructure.
Never trained on your data
First rule of Pitchcrow: your documents, prompts, and decks never train our models, or anyone else’s.
As per your protocols
Authentication, access, and audit controls that fit inside your firm’s compliance perimeter, not the other way around.
Authentication and users
SAML and OIDC SSO, with multi-factor authentication and just-in-time provisioning, IdP- or SP-initiated.
Permissions and document security
Restrict permissions down to individual decks, spaces, folders and files. Members see only what they have been explicitly granted, and nothing else.
Audit logging
Every open, edit, comment, upload, download and deletion across decks, space files, templates and chat, plus every permission grant and revocation. Each entry carries user, timestamp, IP address and device.
Who touches your data
The people, machines and policies that handle your firm’s data.
Employees, thoroughly vetted
Every employee passes a background check and signs a confidentiality agreement. Company machines are managed by MDM, with full-disk encryption and anti-malware enforced.
Your data stays yours
Nothing you upload trains a model, and nothing lingers. Your firm’s data can be exported or permanently deleted on request.
Frequently asked questions
The questions we answer in every diligence review, with the answers up front.
What does Pitchcrow consider customer data?
Everything your firm brings to or creates on the platform: uploaded documents, space files, prompts, chat history, decks, and their metadata. All of it is handled at the same confidentiality tier.
Is my data used to train models?
No. Your documents, prompts, and decks are never used to train Pitchcrow’s models, or any third party’s.
Who can access my documents?
Only the people your admins grant. Permissions can be restricted down to individual decks, spaces, folders and files, and every access is recorded in the audit log.
Where is my data hosted?
On AWS, encrypted at rest with AES-256 and in transit with TLS 1.2+. Each firm’s data sits in its own fully siloed environment.
Can Pitchcrow run in our environment?
Yes. For firms whose policies require it, we offer dedicated deployments with no shared resources, up to and including your own infrastructure. Talk to us about what your protocols demand.
What activity is logged?
Opening, editing, commenting on and deleting decks; deleting items from a deck; uploading, viewing and downloading space files; uploading to and viewing the template library; opening chat sessions; and every permission grant and revocation. Each entry carries user, timestamp, IP address and device.
