Security & governance
How Selvanditem handles data protection, access control, and oversight across the platform — written plainly, without overstating what we are or aren't certified to do.
Request accessSecurity is a design constraint, not an afterthought
Selvanditem is built for advisers who handle sensitive client context. We treat every input, document, and generated briefing as something that needs careful handling — from storage through to deletion.
Advisers often paste client details, portfolio notes, and research questions into tools without knowing where that data ends up or how long it's kept. That uncertainty is a real operational risk, not just a compliance checkbox.
We've tried to reduce that uncertainty by being explicit about what the platform stores, who can access it, and what controls exist to limit exposure if something goes wrong.
- Encryption in transit: all traffic to and from the platform is encrypted.
- Encryption at rest: stored content is encrypted on our infrastructure.
- Role-based access: internal access to customer data is limited by role and need.
- Retention controls: data retention periods are configurable and documented.
What happens to the information you put in
A practical breakdown of how inputs, outputs, and account data are treated once they reach Selvanditem.
Encrypted storage, scoped access
Documents, queries, and generated briefings are stored in encrypted form. Access to this data is restricted to systems and personnel that need it to operate the service — not open by default to the wider team.
In practice
- Encryption at rest and in transit
- No public-facing storage of client content
- Internal access logged and reviewable
You control how long things stick around
Retention settings determine how long briefings and source material remain available before they're removed. Shorter retention windows reduce the amount of sensitive material sitting in the system at any given time.
Configurable by account
- Adjustable retention periods
- Manual deletion on request
- Automated expiry of stale sessions
We try not to collect more than necessary
The platform is designed to work from the inputs you choose to provide for a given briefing, rather than requiring broad, standing access to client records or external systems.
Design principle
- Session-scoped inputs where possible
- No unnecessary third-party data sharing
- Clear separation between accounts
Who can see what, and how that's enforced
Access to both the platform and the underlying data is governed by role, authentication, and account-level separation.
Account-level login
Access requires authenticated sign-in. Sessions are scoped to the individual account and do not expose data across unrelated organisations.
Need-to-know access
Staff access to customer data is limited by role. Routine operation of the service does not require broad, unrestricted visibility into client content.
Isolated accounts
Firms and individual users operate in logically separated environments, so one account's briefings and documents are not visible to another.
How we think about governance day to day
Security isn't a one-time setup — it's a set of habits we try to apply consistently as the platform evolves.
Limit what's collected
We default to asking for only what's needed to produce a given briefing, rather than requesting broad access up front.
Encrypt by default
Data in transit and at rest is encrypted as a baseline, not an optional add-on for certain plans.
Review access periodically
Internal access permissions are reviewed on an ongoing basis so that unused or outdated access is removed.
Make retention explicit
Rather than storing data indefinitely by default, retention periods are stated and configurable at the account level.
Selvanditem is a research tool, not a system of record for client files. We encourage firms to treat it as a working layer for preparing briefings, with their own systems remaining the authoritative record for client data.
Oversight that matches how the platform is actually used
Because Selvanditem is used by advisers under time pressure, governance can't rely on manual checks at every step. Instead, we build constraints into the product itself — scoped access, encrypted storage, and configurable retention — so that reasonable defaults apply even when nobody is actively reviewing a given session.
We also encourage firms using Selvanditem to apply their own internal policies around what information should be entered into any research tool, including this one. Our controls are intended to complement a firm's existing data handling practices, not replace them.
Compliance posture
Selvanditem is a research and drafting aid for advisers preparing their own materials. It does not provide regulated financial advice and is not itself a regulated financial service.
We rely on industry-standard practices for encryption, access control, and data separation as described on this page. We do not claim specific third-party certifications or regulatory approvals unless formally confirmed and documented separately with your firm.
Firms deploying Selvanditem remain responsible for ensuring their own use of the platform complies with the regulatory obligations that apply to them, including rules around client data handling, record-keeping, and suitability.
For questions about a specific security requirement, data processing arrangement, or due diligence request, please get in touch so we can address it directly rather than relying solely on this summary.
Have a specific security question?
If you need more detail on data handling, access control, or governance for your firm's due diligence, reach out and we'll walk through it directly.