Security and data
How Deixio handles your clients’ evidence.
How the software is built: how firms are kept apart, who can do what, how evidence is kept unchanged and how the AI is used. This page lists only what is built today.
Each firm kept apart
- Every firm’s data is isolated twice: by Postgres row-level security and by application query filters. Tests prove raw database queries are isolated too.
- Stored files sit under a key prefix per firm, and access is authorised before any data is returned.
- A prompt to a model never combines two firms’ data.
Sign-in and access
- Sign in with your firm’s identity provider (OIDC).
- SCIM user provisioning; deactivating a user revokes access.
- Every endpoint has an explicit authorisation policy. A token with a missing or inconsistent claim is rejected.
Originals kept as they arrived
- Each original is fingerprinted with SHA-256 at upload and never rewritten.
- An append-only, hash-chained activity log records every correction, decision and signature, with who and when.
- Redaction is burned into exports only; the originals stay unchanged.
Retention
- A firm retention policy, 7 years by default.
- Legal hold per audit.
- Purge deletes the content and keeps the record that it existed.
How the AI is used
- Every model call goes through one gateway. Figures are read by Anthropic’s Claude models.
- Each call is recorded with the model and its version, a hash of the prompt and the token counts. The AI’s working session is kept with the audit.
- Document text is designed to be treated as data, never as instructions. No AI judges another AI: readiness for approval rests on deterministic checks.
Hardening
- Client evidence is never written to application logs.
- Rate limits, security headers, a content security policy and upload size limits. Document parsers run in a sandbox with no network and no credentials.
- Connector access tokens are envelope-encrypted. The build fails on known-vulnerable packages.
Who can do what.
Five roles, with a policy for each sensitive action. An optional independence policy makes one person sign only one role on a workpaper.
| Action | Partner | Manager | Senior | Staff |
|---|---|---|---|---|
| Sign off workpapers | – | |||
| Decide findings | ||||
| Invite the client | – | |||
| Publish to the firm library | – | – | ||
| Export the archive | – | – | – |
Clients have their own role: they upload against each request through a link that cannot reach another audit.
Watch one procedure run, figure by figure.
In 30 minutes we run a procedure end to end on sample data and show you where every figure comes from.
- A source for every figure
- Human in the loop
- Append-only, hash-chained audit trail
Technical questions
What are the upload and rate limits?
Up to 25 MB per file. The API allows 600 requests a minute, uploads 20 a minute and sensitive sign-in actions 5 a minute.
Can we export everything?
Workpapers export as Excel with live links, as PDF with highlights and an evidence appendix, and as an archive (zip) with a SHA-256 manifest.
Is there an API?
Yes: a public API with webhooks and per-audit scoped tokens.
How do clients send documents?
Through a client portal: the client uploads against each request, through a link that cannot reach another audit. When you ask the client about a finding, the question appears there, and the upload triggers a re-run.
Can we see what the AI cost?
Yes. The auditor sees the estimated and the actual AI cost of a session, and admins see metering per audit.