Security
Financial records deserve a higher standard
Statements reveal account numbers, balances and the private affairs of families. Here is exactly how Summafolio protects them, in plain terms.
Safeguards
Encryption at rest, per matter
Every matter has its own data key. Uploaded statements, the ledger and the audit log are encrypted with it (AES-based authenticated encryption via Fernet). Data keys are wrapped by a master key held outside the data store. Connections use TLS.
Automatic deletion
Matters and their statements are deleted automatically after the retention period (90 days by default; firms can choose 7 to 365). Deleting a matter destroys its data key first, so any copy left behind is unreadable.
No training on your data
We don't use customer statements, ledgers or accountings to train AI models, and we don't sell personal data. If an AI provider helps read a statement, it's bound by contract not to retain or train on it, and it's named in our Privacy Policy before it's used.
Append-only audit trail
Every import, category change, allocation override, note, sign-off and export is recorded with who and when. Each entry is chained to the previous one by a SHA-256 hash, so any alteration is detectable, and the review packet includes the verification result.
Least access
Firm workspaces are isolated from one another. Sessions are signed and expire. The application sets strict security headers (Content Security Policy, frame denial, no caching of matter pages).
No matters involving minors
Guardianships and conservatorships of minors, and matters with minor beneficiaries, are blocked: by an attestation when the matter is created, an adult confirmation for each beneficiary and an automatic screen of matter details.
This website
No cookies, no trackers
This website sets no cookies and loads no analytics, advertising or third-party scripts. Fonts are served from our own domain.
Report a vulnerability
Tell us, and we'll act on it
Email security@summafolio.com with the details. Please give us reasonable time to fix the issue before disclosing it, and don't access other people's data or degrade the service while testing. We won't pursue good-faith research that follows these rules.
More detail
Our Security and Data Handling policy describes what we store, where, for how long and who can access it. The Privacy Policy lists our service providers.