Where your record lives, and how it is protected
What is true of this deployment, in plain words: where the data is held, how it is protected on the way and at rest, what the evidence chain proves and how anyone can check it, what a share is, and what the model is never asked. Every line here is a fact about the running system or says that it is not stated.
Where the record lives
One application server and one database, run by the operator. Where that server stands is stated by the operator, never guessed by this page.
- Host and region
- GTHost, Zürich (Switzerland)Whether that is inside the Kingdom is a fact you read from this line, not a promise made elsewhere.
- The database
- PostgreSQL on the same host as the application. It is not reachable from the network; only the application on that host connects to it.
- Uploaded files
- The alerts, reports and letters a firm attaches are kept on the same host, under a directory the web server never serves. The record keeps each file's hash, so a file changed on disk no longer matches its own record.
- Whose data is where
- Every firm's rows carry the firm's identity and every query is limited to it. Another firm's record is not found, not refused: it is a page that does not exist.
How it is encrypted
What is true today, not what would be nice.
- On the way
- TLS, ended at nginx in front of the application. Plain HTTP is redirected, and browsers are told to keep using TLS for a year.Between nginx and the application the traffic stays on the host's own loopback interface; it never leaves the machine.
- At rest
- The database and the uploaded files are not separately encrypted by the application. Encryption of the disk is the host's responsibility and is not asserted here.
- Passwords and sessions
- Passwords are hashed with Argon2 and never stored or logged in clear; twelve characters is the minimum. Sessions are held on the server, in a cookie no script can read, and end after twelve hours in the standard configuration.
- The model's traffic
- When a model provider is configured, requests leave the host over TLS to that provider's endpoint. Which provider, and whether one is configured at all, is a deployment fact; with none configured the product runs on its offline reader.
The evidence chain
What the record is, and how somebody who trusts neither the firm nor the operator can check it.
Every change to a firm's record — a breach recorded, a letter approved, a case closed, a file attached, a share opened — is written as an entry on the firm's own chain, in the same database transaction as the change. Each entry's hash covers its content and the hash of the entry before it, so an entry altered or removed afterwards breaks every hash that follows. The chain is re-read from its first entry every night, and the firm can re-read it on screen at any time.
A firm can publish the head of its chain — the number and hash of its last entry — once a day at a public address. A published head cannot be moved afterwards. When the firm hands an inspector its inspection pack, the pack carries the whole chain as a table; the public verifier re-hashes every entry exactly as the live record does and compares the pack with the heads the firm published. It answers two questions: does the chain inside the pack hold, and is it the record that was published. Nothing uploaded to the verifier is kept.
What a share is
How an inspector, an investor or an auditor reads a firm's record without an account.
A share is a read-only window on a firm's record, opened by the firm for a named reader for a fixed number of days — at most 180 — and limited to the funds, the period and the sections the firm chose. The link is the only credential; it can be revoked at once. Every opening is written on the firm's chain, so the firm can say afterwards which pages were read and when. A share never lets anybody change anything.
What the model is asked, and never asked
The language model reads and phrases. It decides nothing.
- Asked
- To read a fund's published terms into proposed limits, each quoting the sentence it came from; and to phrase a letter from figures it is given. Every proposal is checked: a quote that is not in the document is dropped, a letter that states a number the case does not support is refused, and a person approves before anything is kept.
- Never asked
- Whether a limit was broken, by how much, what the deadline is, or whether to notify. Those are computed by code from the record, and a missing input is reported as not evaluable, never as a breach.
- Your data and training
- No customer data is used to train a model. Spend is capped per firm and per day before a request leaves the machine, and a deployment can run with no model at all.
Reaching the operator
Who runs this deployment, and how to ask a question or report a problem.
- Operator
- ComAgents
- Questions and security reports
- Write to usWe write back within one working day. A due-diligence questionnaire gets the engineering version of this page, with every known gap listed.
ComAgents — the regulator-facing accountability layer for CMA-regulated firms. Public fund catalogue