Data and AI practices

• Client names and contact details never leave your machine. Client files are read in your browser and never uploaded. Names, account and client numbers, contact details and notes stay there; the values of other columns, such as dates, amounts, tiers and statuses, are sent so Wallace can learn how your firm works.
• No AI model is trained on your data. We call the AI through Anthropic's and OpenAI's commercial APIs, whose terms do not allow training models on customer content.
• Your playbook belongs to you. Erase it any time, cancel any time. We never sell data, never share it for advertising, and never use one firm's data to benefit another.

When you add CRM exports, custodian files or other client spreadsheets on the Client data tab of Documents & meetings, they are read by code running in your own browser. The files themselves are never uploaded.

Before anything leaves, Wallace reads the column names and marks private every column that identifies a client: names, birth dates, addresses, email addresses, phone numbers, tax ids, account, policy, client and household numbers, and free-text notes. Your browser also checks the values, and a column holding an email address, a phone number, a Social Security number or a masked account number stays private whatever its name says. A private column's values never leave your browser.

For the other columns, such as event dates, amounts, percentages, holdings and the labels your firm gives clients, your browser sends a summary: each column's values with how often they occur, or its range and a few examples when there are many, and how pairs of those columns' values fall together, counted. Rows are never sent whole, and no row and no client's value is stored. Wallace keeps what each file is, what its columns and codes mean, and the facts it learned about your firm, such as volumes, service mix and timing, never a fact about a single client. Every fact passes a privacy check before it is kept.

Client emails and planning PDFs follow a stricter path: what leaves your machine is a set of anonymized patterns, and the key linking anonymous codes back to your clients is stored only in your browser.

Firm documents are different from client data, and we treat the difference honestly. When you upload SOPs, policy manuals, or procedure documents, their text is stored with your account. That is what makes the product useful: your understudy quotes your documents back word for word, with receipts pointing at the exact section and sentence.

Firm documents describe how your firm works, not who your clients are. We tell you to keep client files out of that section, and the client-data pipeline described above remains browser-only regardless. You can delete any stored document at any time from the Documents & meetings page, and you can see exactly what was extracted from each document before your playbook is compiled from it.

Wallace Understudy uses two AI providers, Anthropic and OpenAI, each through its commercial API. Their models write your playbook, run the interview, answer questions and grade checks; distill the firm documents you chose to store into the quotable items your playbook is built from; build the numerical index that lets a question find the passages that answer it; and read the summaries of client files described above.

The AI providers we use receive only these kinds of material: from client files, the column names and the summaries of their non-private columns described above, plus anonymized patterns from client emails and planning PDFs; the text of firm documents you chose to store; your interview answers; and the questions typed into Ask. No provider receives raw client files, the values of private columns, or the key linking anonymous codes to clients, because none of those ever reach our servers.

We access Claude exclusively through Anthropic's commercial API, which is governed by Anthropic's Commercial Terms of Service. Three facts about that arrangement matter to advisors:

• No training. Under the Commercial Terms, Anthropic may not train models on customer content. Data sent through the API is not used to improve or train any AI model. This is the default for commercial API customers, not an opt-out we had to configure.
• Limited retention. Anthropic's standard API retention is seven days, held for trust and safety screening, then deleted. It is not retained for training under any circumstances.
• Output ownership. The Commercial Terms assign ownership of outputs to the customer. Your compiled playbook is yours.

We access OpenAI's models through its API, under OpenAI's business terms. Under those terms, data sent through the API is not used to train or improve OpenAI models; it is kept for up to thirty days for abuse monitoring, then deleted.

These statements describe both providers' published terms as of September 2026. We monitor them and will update this page if they change.

Your account data, compiled playbook, stored firm documents, and what Wallace learned from your client files live in a dedicated PostgreSQL database hosted by Supabase, protected by row-level security policies that scope every record to your firm. One firm's data is never readable by another. The application is hosted on Vercel, and all traffic is encrypted in transit with TLS. Transactional email, such as sign-in links, is delivered through Resend.

Our subprocessors are: Anthropic and OpenAI (AI processing, including document distillation and the search index), Supabase (database hosting and authentication), Vercel (application hosting), Resend (transactional email), Stripe (billing), and PostHog (product usage analytics). PostHog receives which screens are opened and which actions are taken, by account identifier, and never the content of your documents, playbook or conversations. We do not sell data to anyone, share it with advertisers, or grant any third party access beyond these named processors.

A firm signs itself up or is invited; either way, each firm controls its own seats: the advisor account, and a team seat the advisor grants and can revoke: a junior advisor, ops, a CCO, or a successor. Seat holders can read the playbook and ask the understudy questions; they cannot upload data, change settings, or alter the record.

The playbook itself carries a change record. Every version records where each rule came from, whether it was observed in data, said in an interview, or extracted from a document, and every version keeps a plain summary of what changed. Questions the understudy could not answer are logged as anonymous topics only, with no record of who asked.

Your documents never leave your hands: what you upload is read into the playbook, and the originals stay with you. You can delete stored firm documents yourself from the Documents and meetings page, delete a captured client file or everything learned from one system's files from the Client data tab, or erase your whole understudy from Settings at any time. If you cancel, your content stays readable for 90 days and is then erased from our systems; your sign in and seats stay so you can come back.

This page describes how we handle data. It is not legal advice, and Wallace Understudy is not a compliance program: the product documents and measures how closely your practice follows its own stated process, and your compliance obligations remain governed by your own policies and counsel. Where we describe another company's terms, such as Anthropic's or OpenAI's, we are summarizing their published commitments, which those companies control.

Ask us anything about this page at support@wallacefinance.io. If your compliance officer wants to walk through it on a call, we are glad to.