Security and compliance
How Advisor Ready handles your firm's data
You are a regulated firm and we are your vendor. This page is written for your compliance officer: what the system touches, where data lives, and the lines we never cross.
The lines we never cross, in writing.
- Never: Investment advice, recommendations or portfolio content
- Never: Custodian logins, trading or money movement
- Never: Client messages sent without a person at your firm approving them
- Never: Client data used to train AI models
- Never: Client names or numbers in a case study without written permission
Your data stays in systems your firm controls.
Your accounts, not ours
Each firm's automations run in an account the firm owns. Our access is granted by you and can be removed by you.
Nothing stored on our side
Drafts, approvals, notes and sends are written back to your CRM or archive. We keep no copy.
Least access
We request only the permissions each workflow needs, and nothing at your custodian.
Written down
Every engagement includes a data processing agreement and a one-page summary for your compliance officer.
The four rules every build is designed around.
| Rule | What it means for your firm | What we do about it |
|---|---|---|
| Regulation S-P, as amended | Firms must oversee service providers, run an incident response program and notify clients of breaches. | A written security policy, a data processing agreement and a breach notice clause in every contract. |
| Books and Records Rule 204-2 | AI notes, summaries and transcripts can count as firm records. | Every output is written back to your CRM or archive. Nothing lives only on our side. |
| Marketing Rule 206(4)-1 | Testimonials and reviews are allowed with disclosures, oversight and recordkeeping. | Any review or referral request includes the disclosures and a sign-off step for your compliance officer. |
| SEC exam focus on AI | Examiners ask how firms supervise AI and whether claims about it are accurate. | Human approval on every client-facing message, and a plain description of what the AI does and does not do. |
This is a working summary for discussion, not legal advice. Your compliance officer and counsel have the final word on how each rule applies to your firm.
Questions compliance officers ask
Do you store any of our client data?
No. Workflows run in automation accounts your firm owns, and every output is written back to your CRM or archive. Nothing is kept on our side.
Is client data used to train AI models?
No. AI steps use API access with data retention turned off where the provider allows it, and client data is never used for training.
Can our compliance officer review the system before it goes live?
Yes. They receive a one-page description of what the system does and does not do, and the build is reviewed with them before launch.
What happens if we stop working together?
You remove our access. The workflows keep running in your accounts and remain yours.
Bring your compliance officer to the audit.
We walk through exactly what would be built, what it touches and what it never will, before you commit to anything.
Book the practice audit