Built for a regulated environment
Built for regulated desks. EU-resident by design.
Pasted investor-relations material may contain inside information. The login exists for that reason first. Storage and inference are held in-region, access is gated and tenant-isolated, and the design separates where data is stored from where it may be sourced.
Data residency
Persistent data stays in London.
Supabase Postgres, Auth, and Storage run in the London region (eu-west-2). All persistent data stays in-region. There is no out-of-region replica of stored documents, claims, or surfaces.
Storage is what is regulated, not sourcing. Sourcing may reach anywhere in the world; a public-sourcing request carries a query out, never stored material. Only stored data and document text sent to inference are held in-region.
Document text goes to the EU, never the US.
Claude runs via AWS Bedrock on an EU inference profile, not the direct Anthropic API. Document text enters through London and stays within the EU.
The fallback chain is EU-only: another EU Bedrock region, then an EU Vertex path. There is no fall-through to a US region. Restricted content does not leave the EU.
MNPI handling
Restricted documents are handled as restricted.
Anything that may contain inside information can be flagged as restricted on paste, and then it is:
- Encrypted at rest in a private bucket
- Held to a 30-day default retention
- Reachable only through signed URLs on demand
- Sanitised before persistence, and never treated as instructions to the model
Access and tenancy
Auth gates everything. Multi-tenant from day one.
Access is by magic-link, and an open URL onto a store that may hold inside information is exactly what the login prevents. The schema is multi-tenant from the first migration: a user_id column and row-level security on every table, so onboarding a second client is a grants change, not a rebuild.
Information barriers are designed toward now, not bolted on later. Data-depth regime (listed or private) is a separate axis from access control, and the two are never conflated.
Secrets never reach the repo.
Keys live outside version control. A pre-commit hook scans staged changes as a fast local floor, and Gitleaks runs in CI on every push as the machine-independent control, scanning the full working tree and history.
Trust that shows its work.
The same discipline that keeps data in-region keeps the analysis honest: nothing asserted beyond what the sources support.