Built like the evidence depends on it.

Multi-tenancy is enforced structurally, not by convention. Every query path runs behind Postgres row-level security scoped to the tenant, so an application bug cannot become a cross-tenant data leak — the database itself refuses cross-tenant reads and writes.

Within a firm, each client's memory and conventions are separated: one client's coding history never informs another's unless the firm explicitly marks a convention as firm-wide.

Every inference payload passes through a masking gateway before it reaches a model. In the text of a prompt, Social Security numbers, EINs and bank account numbers are replaced with stable pseudonymous tokens; the re-identification map stays in our infrastructure, and model responses are re-hydrated there. Names and postal addresses in the text are not masked today.

The larger limitation, stated plainly because it matters: masking operates on text only. Images and scans — the PDF pages and receipt photos sent for vision extraction — go to the model provider as-is, so every identifier visible on a scanned statement or payroll summary reaches the provider unredacted. Zone redaction of document images is planned and not yet built.

Inference runs through the providers' commercial APIs, under terms that do not use the content to train models, and we never use client financial data to train models ourselves. Prompts carry only the fields a task needs, and the same text masking applies to logs. The providers are named on the sub-processor list.

Finalized entries are never edited in place. The finalized ledger is append-only double-entry; corrections are explicit adjusting or reversing entries linked to the original, so the record of what changed — and why — is itself part of the books.

Closing a period locks it: the service refuses new journals and in-place edits against a closed period, and corrections go through the same sign-off workflow as everything else.

Every agent action is recorded with its trigger, the retrieved context, the tool calls and their results, each factor of the autonomy decision, the verification-gate result, the outcome, the human who resolved it if any, and the pinned model version and configuration.

The log is append-only — the application role holds insert and select rights and nothing else. A reviewer can see exactly what the agent saw and why a gate passed or failed.

The agent is a preparer, never an authorizer. Every binding action carries an approval token that only the policy engine can issue; the services that touch the ledger verify that token's signature and refuse to act without it. Tokens are Ed25519-signed, single-use, and bound by hash to the exact request body they authorize, so an approved action cannot be swapped for a different one.

A material item that fails a verification gate can only proceed by an explicit, attributed, logged human override — never by the agent retrying until it passes. Finalizing a period always escalates to a human.

A kill switch drops any firm or client to fully supervised mode instantly, without losing state or work in progress.