Security
Industry leading security
Independently audited, encrypted end to end, and nothing retained once you delete it.
01
Cyber Essentials Certified
ExactSum security practices and controls have been independently audited by experts.
02
Encryption
Data is encrypted in transit and at rest using the most secure algorithms available.
03
Zero Data Retention
Your data is never used to train AI models and is deleted permanently once you remove it.
01 / Controls
Every control, in one list
Nothing here is aspirational. Each control below is in place today, and each is covered by the independent audit behind our Cyber Essentials certification.
Cyber Essentials Certified
ExactSum security practices and controls have been independently audited by experts.
Encryption
Data is encrypted in transit and at rest using the most secure algorithms available.
Zero Data Retention
Your data is never used to train AI models and is deleted permanently once you remove it.
Two Factor Authentication
All internal accounts require two-factor authentication to mitigate the risk of unauthorised access.
Zero-Trust Architecture
ExactSum was architected from the beginning with security in mind. We employ a zero-trust security model, which means that no components or systems can communicate with each other without specific authorisation and authentication.
Principle of Least Privilege
Only strictly required access is granted to accounts and personnel to minimise risk.
Regular Access Reviews
Access to systems and accounts is regularly reviewed to ensure no personnel have inappropriate access to systems or data.
Automated Security Checks
All code, libraries and operating systems are regularly scanned for vulnerabilities and patches or updates are made to mitigate identified security issues.
Continuous Security Monitoring & Threat Detection
We leverage modern AI tools and run continuous monitoring on our infrastructure. Threat detection monitors for malicious activity and anomalous behaviour to keep systems and data secure.
Secure Links for Client Login
ExactSum leverages secure links for client authentication. This is more convenient for clients and more secure because terminated client users can no longer access ExactSum once their IT department shuts off e-mail access.
Self-Hosted and Tokenised Data Options
ExactSum can be configured with a self-hosted or third-party data storage layer so that files never touch ExactSum servers or infrastructure. You and your client interact with ExactSum directly, but the files are stored on independent infrastructure, much like an e-commerce site uses a third-party payment processor like Stripe for credit cards.
Account Level Security
All accounts must meet minimum requirements for password complexity. Account sessions are protected through inactivity timeouts.
02 / Your data
What happens to a statement you upload
The shortest possible answer: it is processed, it is returned to you, and then it is gone. The longer answer is below.
Deleted within 24 hours
Uploaded files and everything derived from them — extractions, exports, cached analysis — are permanently deleted within 24 hours. Deleted data cannot be recovered by anyone, including us.
Never used for training
Your documents are not used to train models, ours or anybody else's. There is no opt-out to find, because there is nothing to opt out of.
Optionally, never on our infrastructure
ExactSum can be configured with a self-hosted or third-party storage layer, so files never touch our servers at all — you and your client interact with ExactSum, the documents live on infrastructure you control.
See it on your own files
Send us five statements from cases you've already decided. We'll show you what ExactSum returns and how it compares to the calls your team made.