MFA before confidential access
Private Studio stays locked until authenticator-app multi-factor verification is completed. A signed-in session alone is not enough.
SECURITY & PRIVACY
Your financial work is private by design.
Private Studio combines verified access, separation from the public product, encrypted cloud infrastructure and no model training on API data by default. This page explains what actually happens to your data.
MFA REQUIREDPUBLIC / PRIVATE SEPARATEDAES-256 / TLS INFRASTRUCTURENO API TRAINING BY DEFAULT
HOW YOUR DATA IS PROTECTED
Private work is kept out of the public product
Uploaded financial models and deal assumptions are not exposed in the Public Dashboard, and engagement-specific Private analysis is not written to the global public cache.
Encrypted in transit and at rest
BankMetrics AI runs on Google Cloud and Supabase infrastructure. Supabase encrypts customer data at rest with AES-256 and protects API traffic with TLS.
AI inputs are not model-training data
OpenAI API inputs and outputs are not used to train or improve models unless explicitly opted in.
WHEN YOU USE A FILE IN PRIVATE STUDIO
01 · Verify
Authenticator-app MFA is required before Private Studio opens.
02 · Analyze
Your uploaded file is used for the Private Studio analysis flow. The original workbook and engagement-specific analysis are not written to the Public Dashboard cache.
03 · Use AI when requested
If you request AI narrative, relevant analysis is processed through the OpenAI API. API data is not used for model training by default.
INDEPENDENT ASSURANCE IN THE STACK
Built on infrastructure with independent security assurance.
These are certifications and assurances of the underlying providers, not certifications of BankMetrics AI itself. They are nevertheless important evidence about the infrastructure handling your data.
SUPABASE
SOC 2 Type 2 · ISO 27001
Supabase states SOC 2 Type 2 compliance and ISO 27001 certification, with AES-256 encryption at rest and TLS for data in transit.
Verify on Supabase SecurityGOOGLE CLOUD
Encrypted Cloud Run infrastructure
Google Cloud states that Cloud Run data is encrypted at rest and Cloud Run traffic is encrypted in transit, including forwarding inside Google infrastructure.
Verify Cloud Run securityOPENAI API
No API training by default
OpenAI states that API inputs and outputs are not used to train or improve models unless explicitly opted in. Under standard abuse monitoring, API content may be retained for up to 30 days.
Verify OpenAI API data controlsBANKMETRICS AI CERTIFICATION STATUS
Provider certifications are not presented as our own.
The BankMetrics AI application itself has not yet completed independent SOC 2 Type II / ISO 27001 certification. For bank vendor review, we distinguish this clearly from the certification scope of our infrastructure providers.
NEXT FOR BANK DEPLOYMENT
Private / On-prem / Air-gapped deployment
For institutions that require full isolation, the next phase will make AI, identity, database, storage and PPTX generation replaceable inside a private or air-gapped environment.