Terms of use

Who runs this

Your hub is provided to you by your adviser firm. The software behind it is built and run by Independent Check Ltd (company 08302295, Celtic House, Caxton Place, Cardiff, Wales, CF23 8HA), who hold your information on that firm’s instructions and on nobody else’s. Your firm decides what goes into your hub and who may see it. We do not. We do not sell it, and share it only with the sub-processors named in the data processing agreement, to run the service.

In the language of UK data protection law, your adviser firm is the controller and Independent Check Ltd is their processor. What your firm does with your information is their privacy policy’s business. What this software does with it is below.

What this is for, and what it is not

A hub is a place to keep a household’s financial picture in one legible form and share it with the people who need it. Nothing on it is financial, legal or tax advice. A figure on a page is a record of something a document said, or arithmetic over those records — never a valuation and never a recommendation.

What happens to a document you upload

When somebody who can see all of your hub asks for a document to be read, it goes to Anthropic’s Claude API, which finds the facts in it and the lines each one came from. What is sent is the document’s text with its lines numbered — or the file itself: a photograph as it is, and a PDF whole, every page of it, when any one page could not be read on our own server or while our server’s PDF reader is unavailable — together with the names of the people already in your hub, the kinds of record it already keeps (with their categories and the details each is expected to have) and the questions it has already asked with whether each has been answered (never the answers), so that a document naming Grace is matched to the right person and nobody is asked the same thing twice. Not the filename.

The same API answers the hub’s assistant, the Companion. When you write to it, it is sent your message and your own conversation with it so far (nobody else’s, and only the last eight thousand characters or so), your name and what you may see, the hub’s name, the names of its people with the identifier each has here, its pages, what each record you may see is — its kind, its label and whether it has been approved — the gaps you might be asked about, and, if you are the hub’s owner or adviser, the layout instructions your household has given it. It is never sent a record’s value or date or a sentence quoted from a document, though a label, a title or your own words may contain one. After a change to your hub, an outline of the same kind, as your adviser sees it and with their name, is sent without anybody asking, to suggest a topic your adviser may want to raise with you.

Under Anthropic’s commercial terms none of this is used to train their models, and they delete it within thirty days unless they must keep it longer to enforce their usage policy or the law. Anthropic is a sub-processor; the data processing agreement between us and your firm names them and sets out exactly what each use sends.

What comes back is a proposal, and it stays marked as one until your adviser has looked at it. A reading appears in your hub straight away, labelled as awaiting your adviser’s approval, and every total it is part of carries that same label — so a figure is never quietly half-checked, and you can see which parts of it nobody has confirmed yet. Approving a reading is what takes the label off. A reading your adviser rejects counts towards nothing at all.

No total is written by a model. A model reads a value out of a document — the valuation beside a pension is its reading of one sentence, carried as the document gives it and quoted underneath — and every total, count and comparison over those readings is arithmetic done by this software. The words a model writes for your pages, for a suggested topic and in the Companion’s replies are refused if they contain a number, in digits or in words. The exception is what a model writes while it reads a document — the wording of a question it raises, the label it gives each record it finds, and its one-line summary of the document — which is not checked that way and may repeat a figure the document gave.

Every fact says where it came from, and there are three answers. Most were read out of a document and carry the lines they came from, which you can open. Some came from an answer somebody gave, and carry the answer, who gave it and when. Some were typed in by your adviser, and carry their name. A fact with none of the three cannot be stored: the database refuses it. A reading your adviser corrects is superseded rather than overwritten — the original stays, with its own citation, for as long as the record does.

Where it is kept

Each firm’s records live in a database of their own, with the sensitive fields and the uploaded files encrypted using a key belonging to that firm alone. Independent Check Ltd hold the master key that unwraps those keys, so we are technically able to read a firm’s records. That is a deliberate choice rather than an oversight: a firm that lost its own key would otherwise lock a family out of their records for good. We enter a firm’s records only to give support the firm asked for, to investigate an incident, or where the law requires it. When we come into a firm through the software, its own audit trail says so, with our reason; when we add somebody to a firm’s staff, its audit trail shows that too, though without a reason. Reading records straight from the server, which holding the master key makes possible, is not something the software can record.

How long your records are kept is your firm’s decision rather than ours: nothing expires by itself. Something deleted stays in our encrypted nightly backups until they expire, thirty-one days later. Ask your firm, or read their privacy policy.

Using it

Do not upload anything you have no right to share, and do not try to reach a hub that is not yours. Access is granted by your firm and by the hub’s owner, and either of them can withdraw it. If you think somebody else has your sign-in, tell your adviser and sign in again — signing in ends every other session on your account.

We keep the service running as well as we reasonably can, and it can still be unavailable. Nothing here is a promise that it will be up at any particular moment, and a hub is not the only place a household’s important papers should exist.