Security + Compliance
Your client data is not a product. It's a liability your firm holds under professional privilege. We built Praxis to treat it that way.
Data isolation
Praxis is multi-tenant at the application layer but physically isolated at the data layer. Each firm gets its own database schema and its own S3 prefix. A cross-tenant query is architecturally impossible — it would require breaching the isolation at the infrastructure level, not the application level.
Isolated database schema per firm tenant
Isolated S3 prefix for all documents, logos, workpapers, and avatar assets
OAuth credentials stored per-tenant — never shared, never cross-referenced
Approval queues and decision logs are firm-scoped and inaccessible to other tenants
Firm tenant IDs are never exposed in URLs or API responses
Infrastructure stack
Hosting
AWS (us-east-1, us-west-2)
Encryption at rest
AES-256
Encryption in transit
TLS 1.3
BAA coverage
AWS Business Associate Agreement
Backups
Daily automated
Compliance posture
We're a founding-stage product. We'll be honest about what's in place and what's in progress.
Business Associate Agreement (BAA) available for Enterprise tier firms. PHI handling protocols implemented. Audit trail logged. AWS BAA executed as the infrastructure sub-processor.
Targeting Q1 certification. Controls designed and implemented. Audit in scheduling. We'll notify all subscribers when certification is received.
Every AI action logged with timestamp, action, confidence level, firm configuration at time of action, and approver identity. Logs are write-once and cannot be modified. Full audit trail.
Human approval gates
Default configuration at signup: zero autonomous financial writes. Every transaction routes to your approval queue. You raise the auto-approve threshold deliberately — only when you're confident in the system's performance on your clients' data.
Confidence threshold
You set the minimum confidence score (default 80%) for autonomous classification. Below threshold: approval queue. You can raise or lower it per client.
Amount limit
Optional: set a maximum transaction amount for autonomous processing. Large transactions always route to you regardless of confidence.
Vendor exceptions
Specific vendors can be flagged to always require your review — useful for unusual vendors, recurring reclassifications, or high-risk categories.
Reversibility window
Every AI action is reversible within 30 days. A journal entry you approved can be reversed with a single click and a logged reason.
Access controls
Every action on Praxis is attributed to a specific user with a specific role. Roles are firm-defined. SSO is available on Enterprise. Shared login credentials are not permitted.
Partner/Owner
Full access: approve financial actions, configure rules, access all clients, manage billing
Manager
Approval queue access, client data view, reports — no billing, no rule changes
Staff
Read access to assigned clients, report view, no financial action authority
Sub-processors
We don't use vendors we wouldn't disclose. Here's the full list.
AWS
Compute, storage, database. Primary infrastructure. BAA executed. US residency.
All data. Covered by BAA for HIPAA-eligible workloads.
Synthesia
Video rendering for Virtual Twin feature.
Video script + avatar ID. No client financial data. No personally identifiable client information in the script.
Microsoft Graph
Email and calendar integration for M365 firms.
OAuth token only. Email content is processed on-platform, not sent to Synthesia or any other third party.
Stripe
Payment processing.
Billing information only. Zero client financial data.
Email security@rtwadvisors.net. We respond to security questions within 24 hours. BAA execution requests handled same day for Enterprise tier.
