Private by default
Documents live in a private vault, encrypted in transit and at rest by our infrastructure providers.
Trust & security
Your financial life is sensitive. Authority over it should stay explicit.
X1 protects the documents behind your financial picture, limits access to the people you authorize, and keeps supported AI work tied to sources you can inspect.
Specific access
Household and professional access is scoped to current relationships and explicit sharing grants, which can be revoked.
Source-backed AI
On supported document-grounded workflows, X1 presents source citations so you can verify the answer.
Accountable handoffs
We record key document access and sharing events to support accountability, security review, and incident response.
Current posture
The short answers, stated precisely.
Claims reviewed
- SOC 2
- Readiness is in progress. X1 does not currently hold or claim a SOC 2 report or certification.
- Data use
- We do not sell household data or use it for advertising. X1’s policy is not to grant model providers permission to train on household content.
- Diligence
- Firms can request our current controls, subprocessor posture, and evidence status under NDA.
Before anything leaves your household
You can see the handoff before you approve it.
Limited authorized X1 personnel and subprocessors may process data when needed to operate and secure the service. Household and professional access remains scoped to current relationships and explicit sharing grants.
- 01
X1 shows the consequence
Before approval, the household can see what will be prepared, who is expected to receive it, and what happens next.
- 02
The household confirms
Nothing is sent until the household approves the material and the intended recipient.
- 03
The trail stays legible
The handoff, response, and confirmed outcome remain connected to the sources that produced the work.
AI you can interrogate
Useful intelligence needs governed boundaries.
X1 uses commercial API services—not personal chatbot accounts—for production processing. We do not grant model providers permission to train on household content; exact contractual coverage and retention are verified route by route.
- We are verifying contractual coverage and retention settings route by route.
- On supported document-grounded workflows, X1 presents source citations so you can verify the answer.
- Selected professional workflows require human review before client delivery.
- Discovery material an advisor provides for a pre-client brief is read once to build the cited draft and is not stored as source files. The approved brief lives in the firm’s private workspace, and its share links are unlisted and revocable.
Your data choices
A household record should remain answerable to the household.
Access, export, correction, login removal, content deletion, and verified erasure are related choices—but they are not the same operation. X1 explains the scope and consequence of each.
Review your privacy rights- Access
- Ask what personal information X1 holds about you and how it is used.
- Export
- Export supported household-record sections or request a fuller access extract when self-serve limits apply.
- Correct
- Correct inaccurate information and the facts X1 organizes from your record.
- Request erasure
- Ask X1 to verify and fulfill an erasure request. Ending account access or removing a login identity is separate and does not itself prove system-wide erasure.
Compliance status
SOC 2 readiness, stated precisely.
X1 is operating a readiness program focused on Security and Confidentiality, with Privacy controls being prepared in parallel. We do not currently hold or claim a SOC 2 report or certification.
For firms and advisers
A diligence conversation with evidence.
We can discuss our security architecture, data flow, access model, subprocessor posture, AI use, deletion controls, and current evidence status under NDA.
Start security diligenceA question we have not answered?
Ask us directly about the security posture behind X1.
We will share what we can plainly, including where a control depends on an infrastructure provider or remains in progress.