Security
Your numbers under your control.
Finance data is the most sensitive data a company has. Here is how finstory keeps it safe, who can see it, and what the AI is and isn't allowed to do.
Where your data lives
finstory runs on Google Cloud in the United States. Data from the EU or UK is transferred under the EU Standard Contractual Clauses.
Encrypted everywhere
Data is encrypted in transit and at rest, and the credentials that connect finstory to your ERP are stored encrypted too.
Sign-in you already trust
Sign in with Google or Microsoft, so your own identity policies apply, or with email. Access to our production systems is restricted and monitored.
Roles and permissions
Readers view, editors build and publish stories, power users manage reports and data, and only admins can grant admin rights. Admins and power users can also load and delete data from Claude, with the separate Data Admin connector.
Publishing you control
Keep a story private, share it with your company, send it to named people, or create a link that expires. Revoke access at any time.
Saved in your workspace
Reports and stories that Claude creates or edits are saved in your workspace. A new report stays an unpublished draft until a power user or admin publishes it, and a story Claude creates stays private to you until you share it. Changes to a report or story that is already published or shared show straight away.
Clear limits for the AI
finstory works inside your own Claude. Claude only sees what finstory returns for your request, from the workspace you signed in to, within your role. Only admins and power users can load or delete data, with the separate Data Admin connector.
Your data stays yours
You own your data and everything derived from it. We never use it for marketing, demos or anything outside your account.
Leaving finstory
We keep your data for as long as you subscribe. When your subscription ends, we keep it for up to 30 days so you can export it, then delete it. Backups that contain it are purged within 60 days of the end of your subscription, unless the law requires otherwise.
Report a vulnerability
Found a security issue? Tell us first.
Email security@finstory.ai with the address (URL) where you found it, the steps to reproduce it and the impact: what someone could do with it.
Email security@finstory.aiIn scope
finstory.ai, the finstory app at app.finstory.ai and the finstory connector for Claude at mcp.finstory.ai.
What happens next
We acknowledge your report within two business days and send a first assessment within five. We keep you updated until the issue is fixed.
The rules
Don't access or change other customers' data: use your own account or test data. No denial-of-service tests, and no social engineering of our team or our customers.
Good faith
We won't take legal action against good-faith research that follows these rules.
Security review
Need the details for your review?
Request our security documentation, shared under NDA. We usually reply within one business day.