How we keep your data safe.

The hosted service runs on Google Cloud in the United States. Sigmaflo processes your data solely on your instructions, under a data processing agreement. If your data must remain in your own environment, Sigmaflo is also available as a customer-hosted deployment, described below.

Yes. Sigmaflo offers a customer-hosted deployment that runs within your own cloud account or on-premises infrastructure. Your data remains there, subject to your own storage, network, logging and key management controls, and no copy is retained in Sigmaflo's environment. Where support requires access, you grant it to a named individual for a defined period.

Yes. All connections are encrypted using TLS 1.2 or higher. In the hosted service, data at rest is encrypted with AES-256, with keys managed by Google Cloud Key Management Service. In a customer-hosted deployment, your own storage encryption and key management apply, and we verify the configuration with your team before production use.

Sigmaflo connects to your ERP or data warehouse through a read-only integration and ingests only the fields required for statement preparation. It does not write back to your ledger. For customer-hosted deployments, we also document the minimum permissions and network connections the software requires, and you decide when each update is applied.

No. Every reported figure is produced by deterministic code, covering ingestion, tie-outs, matching, allocations and statement assembly. A model may propose a mapping or classification, or draft commentary, but a proposal takes effect only when a person accepts it, and each acceptance is recorded. Integrity checks, such as balancing and rollforward checks, run independently and will fail a run regardless of any narrative output.

In the hosted service, model inference runs on Google Cloud's Vertex AI, within Sigmaflo's Google Cloud environment. In a customer-hosted deployment, inference runs through the model service in your own cloud account, under your own cloud agreement. In both cases, we use model services only under business terms that prohibit training on customer data, and never through consumer applications. The software is designed so that a model receives only the information a specific task requires, rather than complete ledgers or trial balances.

No. Customer data is never used to train models, to improve results for other customers, or for any purpose other than delivering and supporting your service.

Text in a vendor name or memo field could be written to manipulate automated processing. For this reason, there is no path from model output to a financial figure: a model cannot post a journal entry, change an amount or approve an item. Any text generated by a model is clearly labeled and must be reviewed by a person before it is accepted.

Yes. On request, we can scope an engagement with model-assisted features disabled. The deterministic process, from source entries through to the finished statement, continues to run.

Access is limited to individuals who need it to deliver or support your service, in three roles: the founder, engineering, and an accounting specialist who reviews outputs for accounting accuracy. Access is granted to named individuals on documented approval and reviewed quarterly, and there are no shared accounts. Administrative actions in the hosted service are recorded in Google Cloud audit logs. In a customer-hosted deployment, no one at Sigmaflo can access your environment unless you grant access. Multi-factor authentication is required on every account, and administrators use phishing-resistant methods.

Employees and contractors are held to the same standard. Before receiving access to customer data or production systems, each person completes background screening, including identity and right-to-work verification, employment and education verification, and reference checks, with criminal records checks where permitted by law. All personnel sign confidentiality, acceptable use and intellectual property agreements, and complete security training at onboarding and annually thereafter.

Every device used for Sigmaflo work must have full-disk encryption, automatic screen lock and a current operating system with automatic security updates. Removable media may not be used for customer data. If a device is lost or stolen, we revoke its sessions and credentials and rotate any secrets it may have held. Contractors using their own equipment must meet the same requirements and confirm compliance in writing.

Changes to protected branches require a pull request and must pass automated checks before merging, including static analysis, dependency scanning and secret scanning. Our remediation targets are 7 days for critical findings and 30 days for high-severity findings. Third-party dependencies are reviewed before adoption and pinned to specific versions.

Not yet. An independent penetration test is planned, followed by annual testing, and we will share the summary report with customers. Current code scanning results are available under NDA. If you run Sigmaflo in your own environment, your team is welcome to test the deployment before it processes production data.

We will notify your designated security contact within 72 hours of becoming aware of any incident that affects or could affect you, including a compromise of our software, our accounts or the support access you have granted. The notification will describe what is known, the likely impact and the steps taken, and will be followed by a written post-incident report. Incidents are managed under a documented response plan with defined severity levels and a single accountable owner.

Your source data remains in your ERP at all times. Your data, statements and audit trail can be exported at any time in open formats (CSV, XLSX and JSON). The rules that produce your figures are documented and can be inspected, so your team can understand how every number was derived.

Our support response commitments are 4 business hours for critical issues, 1 business day for high-priority issues and 3 business days for normal issues. Availability targets for the hosted service are set out in your order form. In a customer-hosted deployment, availability follows your own infrastructure.

Please email security@sigmaflo.ai with a description of the issue. We aim to acknowledge every report within one business day.

In the hosted service, Google Cloud provides infrastructure and Vertex AI model inference in the United States. The tools we use to run our own company, such as Google Workspace and GitHub, do not receive your financial data. Every vendor is assessed before use and reviewed annually, and we provide at least 30 days' notice before adding any subprocessor that would handle your data, so that you can object. In a customer-hosted deployment, no Sigmaflo subprocessor receives your data.

Not yet. Our controls are designed against the SOC 2 Trust Services Criteria and the NIST Cybersecurity Framework, and our data-handling practices are aligned with GDPR and CCPA/CPRA. A SOC 2 Type I examination is planned. Google Cloud, where the hosted service runs, holds its own SOC 2 and ISO 27001 certifications.

Yes. Under NDA, we will share our policy set and a detailed security overview, complete your questionnaire in full, and join a technical review with your security team. Data protection responsibilities are set out in our agreement with you.