Agree the controls before introducing family data.
Set the access, review, retention and processing requirements for the implementation.
Compare the incoming evidence with the approved figures before accepting the update.
Define the information boundary
Identify the required data, authorised users, processing location and retention period. Assign ownership of source access and approval decisions. Agree these controls against the family office’s operating structure before confidential records enter the workflow.
Use the public workspace appropriately
The public workspace separates browser sessions and retains source references and review history. It demonstrates the investment process rather than providing an authenticated production tenant. Use the supplied demonstration documents and keep confidential family or client information out of the public site.
Document the production requirements
Agree identity and access controls, data location, retention, recovery and incident responsibilities before a pilot. Review any external model or integration provider. Avenset does not claim SOC 2 certification or a completed independent security attestation.
- Least privilege source access and a named data owner.
- Clear approval boundaries and an auditable decision history.
- Agreed retention, deletion and recovery procedures.
- Explicit review of any external AI or integration provider.
