Security and confidentiality.
What happens to your draft, who sees it, and when it is deleted. Only what is true today.
From first call to deletion.
- 1
Conflicts check
Within one working day.
- 2
NDA and UPSI undertaking
Signed before any draft.
- 3
Insider record
Entry in your structured digital database.
- 4
Secure transfer
Method agreed in writing.
- 5
Review
Assigned people only.
- 6
Delivery
To the CFO and the audit committee chair together.
- 7
Deletion
30 days after delivery.
What we commit to now.
Confidentiality before any draft
An NDA and a UPSI undertaking signed, and Pramanex recorded as a designated insider in your structured digital database, before any draft is accepted.
No drafts through the website or email
The site forms ask for no documents, and the enquiry forms warn against sending drafts. Anything sent before an NDA is not received in confidence and may be deleted.
Who sees your documents
The professionals assigned to your engagement, under our written review standard. Access is limited to the people assigned to your engagement.
AI processing
Documents are processed by our AI model provider, Anthropic, under enterprise terms that do not allow training on customer data. The full processor list is below.
Where data sits
Review documents are stored in India. The AI analysis runs on an enterprise AI service; where that service processes data outside India, your engagement letter says so before anything is shared. Website enquiries are stored in Mumbai, India.
Retention and deletion
Review documents you supply are deleted 30 days after delivery of the report, or earlier on request, unless the law requires us to keep them. The final report, its list of findings and its fingerprint are kept so that the report can be verified. Contract records are kept for 8 years. Structured digital database entries are kept for 8 years.
Protection
Encryption in storage and in transfer, access limited to authorised people using multi-factor authentication, and review documents kept apart for each client, as our privacy notice commits.
If something goes wrong
We tell affected people without delay, in plain language, and keep a record of every breach and the steps taken, as our privacy notice sets out.
Proof the report was not altered
Each released report has a recorded SHA-256 fingerprint; your browser checks a copy on the verify page without uploading it.
How a draft reaches us
Through the secure transfer method agreed in writing for each engagement, before any draft is shared. Never through this website or by email.
Who processes data for us.
| Role | Provider | Where |
|---|---|---|
| Website hosting | Vercel | USA, with a global edge network |
| Website database (enquiries and requests) | Upstash Redis | India (Mumbai region) |
| AI model provider | Anthropic | Under enterprise terms that do not allow training on customer data |
| Zoho Mail | India |
What is not in place yet. We say so.
Third-party security certification
We do not hold SOC 2, ISO 27001 or any other third-party security certification today, and we do not claim one.
Running inside your own cloud
Pramanex Enterprise, where the draft never leaves your account, is in development and not yet available.
This page summarises our commitments. The privacy notice, the terms and, for an engagement, the signed engagement letter and NDA govern. Not an audit, review, certification or assurance opinion, and not legal advice. Pramanex is not a firm of chartered accountants or company secretaries.
Book a 20-minute call.
Tell us your year end and your timetable. We tell you what we would read, what it would cost and what we need from you. No documents, no obligation.
Your next annual report will be in draft by June.
Have it reviewed before it goes to print.
Under NDA, with Pramanex recorded as a designated insider in your structured digital database.