Security and data handling
Advisers upload other people's financial documents and act for several clients at once. This page describes, in plain terms, how the workspace keeps one firm's data apart from another's and what happens to the files you upload. It describes the product as built; it is not a certification.
Organisations, members and clients
A firm is an organisation. Advisers are its members, as owners or advisers. Clients belong to exactly one organisation, and each client's investment accounts, imports, analytics and reports belong to that client.
Every request to the workspace first resolves the signed-in adviser's membership in the organisation named in the request. A non-member is refused. Client, account and report identifiers are then loaded scoped to that organisation: an identifier that belongs to another firm reads as not found, so the existence of another firm's client is never revealed.
| Action | Who |
|---|---|
| Clients, accounts, imports, review, analytics, reports | Owners and advisers |
| Firm settings, branding, members and invitations, audit log, permanent client deletion | Owners only |
Sign-in and two-factor authentication
Sign-in uses the adviser's e-mail and password. Two-factor authentication with time-based one-time codes (RFC 6238, compatible with common authenticator apps) can be enrolled from Settings; enrolment issues ten single-use recovery codes, shown once. An owner can require two-factor authentication for the whole organisation; a member who has not enrolled cannot open the workspace until they do.
Second-factor secrets are stored encrypted at rest. Access tokens are short-lived and renewed with a revocable refresh token.
Imports and file validation
An import accepts up to five files of up to 5 MB each. File contents are inspected before anything is stored: a file whose bytes do not match its declared type (for example an HTML page named .pdf) is refused. Extracted positions and transactions are shown for review and are only applied when the adviser confirms them; confirmed records are never silently overwritten by a later import.
Retention of source files
Original statement files are kept for seven days after import so the extracted data can be checked against them, then purged. The confirmed positions, transactions, cash flows and every report snapshot remain. Documents are served only through authenticated, organisation-scoped endpoints; there are no shareable file links.
Reports
Generating a report reads the portfolio engines once and stores the result as a versioned snapshot. Downloads render that snapshot, so a report never changes after later statements arrive. The adviser's own commentary is stored in the snapshot and printed as a clearly labelled adviser-authored section.
Audit trail
The following actions are recorded with the acting adviser, the target and a timestamp, and are visible to owners: client created, updated, archived, restored or deleted; cross-border profile changes; account created or deleted; statement uploaded; positions and transactions confirmed; document downloaded; report generated; members invited, joined or removed; firm settings and branding changes.
Deleting data
Archiving a client keeps its history and frees the plan slot. Permanently deleting a client (owners only) removes its accounts, positions, transactions, imports and reports, and purges any remaining source files.
Infrastructure
The workspace runs on the same backend, databases and storage as Borderfolio for investors; see the Borderfolio security page for hosting, providers and sub-processors. Analytics on this marketing site is opt-in and EU-hosted, as described in the cookie notice.
Reporting a problem
Write to [email protected]. Please do not include client documents in the report.