Security White Paper

Last updated: October 2026

This document describes how Tactive protects the data on its platform today. It is written for current and prospective clients, partners and auditors. Where a control is planned but not yet in place, this document says so.

1. Executive Summary

Tactive is a technology platform for financial advisors and wealth management firms. The platform handles client financial data, so security controls apply at each layer: hosting, storage, application, AI processing and operations.

This document lists the controls that exist today, the vendors that process data for us, and the controls we are building next.

2. Certifications & Compliance Frameworks

2.1 SOC 2 Type II

Tactive has completed a SOC 2 Type II audit conducted by an independent third-party auditor. The audit covers the Trust Services Criteria:

Security: protection against unauthorized access
Availability: system uptime and operational resilience
Confidentiality: protection of confidential information
Processing Integrity: accurate and complete data processing
Privacy: personal information handling in accordance with commitments

2.2 ISO 27001

Tactive maintains an Information Security Management System (ISMS) aligned with ISO/IEC 27001. This standard requires us to:

Assess information security risks
Design and implement controls for those risks
Run a management process that keeps the controls effective
Conduct internal audits and management reviews

2.3 ISO/IEC 42001: AI Management Systems

Tactive aligns its AI program with ISO/IEC 42001, the international standard for AI management systems:

Risk-based AI governance: identify and reduce risks specific to AI systems, such as bias, hallucination and unintended outcomes
Transparency: explain how AI features produce outputs, including the ScruffGuard compliance checks
Accountability: keep human oversight on AI recommendations and record which model produced each output
Continuous monitoring: track AI output quality and compliance over time

2.4 GDPR

Tactive supports the General Data Protection Regulation (GDPR) for users in the European Economic Area:

Lawful basis for processing: we identify the legal basis for each processing activity
Data minimization: we collect the data necessary for the stated purpose
Individual rights: individuals can ask to access, correct, erase, restrict or export their personal data, or object to processing. Today, Tactive handles these requests manually: send the request to security@tactive.com. Self-service erase and export functions are in development.
Cross-border transfers: data transferred outside the EEA uses approved mechanisms (Standard Contractual Clauses)
Breach notification: see section 6.3

2.5 CCPA

Tactive supports the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):

Right to know: California residents can ask for the personal information we hold about them
Right to delete: California residents can ask us to delete their personal information. Today, Tactive handles deletion requests manually (see section 5.2).
Right to opt out: California residents can opt out of the sale or sharing of their personal information by writing to security@tactive.com
Right to non-discrimination: we do not discriminate against users who exercise their privacy rights

3. Infrastructure Security

3.1 Cloud Architecture

Tactive runs on Amazon Web Services (AWS), in the us-east-1 (N. Virginia) region only. The infrastructure is defined as code and deployed with SST.

Compute: AWS Lambda (web server, queue workers, scheduled jobs), AWS Step Functions and Amazon SQS
Database: Amazon Aurora PostgreSQL (Serverless v2) in a private subnet, not publicly accessible
Storage: Amazon S3 with Block Public Access on and versioning on for the production buckets
Cache: Amazon ElastiCache Serverless (Valkey), TLS required
Document text extraction (OCR): Amazon Textract, inside AWS
CDN: Amazon CloudFront with TLS termination and the AWS Shield Standard protection that CloudFront includes
Secrets: AWS Systems Manager (SSM) Parameter Store

3.2 Encryption

In transit: CloudFront redirects HTTP to HTTPS and requires TLS 1.2 or higher. Calls from the platform to AWS services and to every vendor use HTTPS. Database and cache connections use TLS.
At rest, database: Aurora storage encryption is on (AES-256) with the AWS-managed RDS key in AWS Key Management Service (KMS). Automated backups use the same key.
At rest, documents: every S3 bucket has default server-side encryption (SSE-S3, AES-256).
At rest, cache, queues and logs: ElastiCache, SQS and CloudWatch Logs use AWS default encryption.
Application level: vendor credentials (Black Diamond OAuth tokens, Capital Preferences firm credentials, the GoHighLevel agency token and social media credentials) are encrypted with AES-256-GCM before the platform writes them to the database.
Document access: files are private. The platform serves them only through signed links that expire (5 minutes for upload, 60 minutes for viewing).

Planned: customer-managed KMS keys with rotation for the database, S3 and SQS; field-level encryption for the remaining token columns; HTTP Strict Transport Security (HSTS) and security headers on every response.

3.3 Network Security

The database and cache run in private VPC subnets and are not reachable from the internet
Public traffic enters through CloudFront
Engineers reach the private network through a VPN
Security groups limit traffic between services

Planned: a web application firewall (AWS WAF) on every CloudFront distribution.

4. Application Security

4.1 Secure Development Lifecycle

Code review: changes go through pull request review before merge
Static analysis: linting and TypeScript type checking run on every pull request
Dependency scanning: Dependabot reports vulnerable third-party packages
Secret management: secrets are stored in AWS SSM Parameter Store and injected at runtime. They are not committed to source control.
Environment separation: production, pre-production, demo and development are separate deployments with separate databases. Pre-production and demo hold a copy of production data for testing; pseudonymization of that copy is planned.

4.2 Authentication & Authorization

Authentication: Better Auth, with email and password, magic link, Google sign-in and multi-factor authentication (MFA) by email one-time code or authenticator app. MFA is available to every user and is not yet required.
Single sign-on: SAML and OIDC single sign-on are supported. Tactive sets them up per firm on request.
Session management: sessions are stored on the server and carried in HTTP-only, SameSite cookies. A session lasts up to 30 days.
Role-based access control (RBAC): organization roles (owner, organization admin, team admin, advisor, member, compliance officer, compliance manager) control what each user can do. Client data visibility has four tiers: platform, organization, team and self. An advisor sees their own clients and the clients of the teams they belong to.
Invitations: users join a firm by invitation. A user can grant only roles at or below their own role.
Platform administrators: Tactive platform administrators can see every firm's data and can impersonate a user to give support. Each impersonation start and stop is written to the authentication audit log.

4.3 API Security

Every API procedure that reads or changes client data requires an authenticated session. Public endpoints (document upload portals, webhooks) require a signed token or a verified signature.
Input validation with Zod schemas on every procedure
Rate limiting on authentication and public endpoints
CORS policies restrict cross-origin requests to authorized domains

4.4 AI Processing and ScruffGuard

Where client data goes. AI features send client data to external model providers and store the answer in Tactive's database. The providers are Anthropic (chat assistant, compliance checks, market commentary), OpenAI (financial plans and proposals, document classification and extraction, meeting preparation, call transcription) and Voyage AI (search embeddings and ranking). Depending on the feature, a request can include client names, contact details, dates of birth, balances, holdings, notes and document text.

Documents: the platform extracts text from uploaded documents with Amazon Textract inside AWS, and then sends the text, not the file, to the model. Files attached to a chat message go to Anthropic as files.
Model training: under their commercial API terms, OpenAI and Anthropic do not train their models on API data by default. Voyage AI states that it does not train on customer data. Tactive does not train or fine-tune its own models on client data.
Provider retention: OpenAI and Anthropic keep API traffic for up to 30 days for abuse monitoring, then delete it. Zero-data-retention terms are being requested from both providers. Details per vendor are in section 7.
Masking: account numbers are cut to the last 4 digits before indexing for search. Other fields are sent as stored; masking of Social Security, account and card numbers before every model call is in development.

ScruffGuard is Tactive's compliance layer for AI output:

Compliance checks: ScruffGuard scans AI output and outbound messages for regulatory problems, such as guarantees of returns, misleading performance claims, suitability issues and missing disclosures. It is not a personal data filter, and it does not stop client data from going to the model providers.
Source attribution: AI answers show the records and documents they used
Human in the loop: AI output is a draft. An advisor reviews and approves client-facing documents.
Record of AI use: each model call is recorded with the provider, the model, the user, the firm, the client and the time. Chat transcripts, including tool inputs and outputs, are stored. Generated plans and proposals store the inputs and assumptions that produced them.

5. Data Protection

5.1 Data Classification

Tactive classifies data into four tiers:

Classification	Description	Examples
Public	Freely available	Marketing content, public documentation
Internal	For internal use	Internal processes, non-sensitive configs
Confidential	Business-sensitive	Client lists, financial models, proprietary algorithms
Restricted	Highest sensitivity	PII, financial account data, authentication credentials

5.2 Data Retention & Deletion

Client records, documents, generated plans, chat transcripts and audit logs are kept for the life of the firm's account. Audit records are kept for at least 6 years (FINRA Rule 4511).
Advisors can archive a client or prospect. Archive hides the record; it does not erase it.
Advisors can delete an uploaded document. Delete removes the file, its search index entries and its database row, and keeps an audit record of the delete.
Erasing a whole client record, or all data of a firm at the end of a contract, is done on request by Tactive engineering today. An audited erase function and a retention schedule are in development.
After a delete, copies remain in database backups for up to 7 days, in prior S3 object versions, and at vendors that hold their own copy (see section 7).

5.3 Data Residency

The platform's database, documents and backups are in AWS us-east-1 (N. Virginia) only
The vendors in section 7 store or process data in their own infrastructure: the CRM and assessment systems (GoHighLevel, Capital Preferences) keep their own client records, and AI model providers receive data for processing
Cross-border data transfers comply with applicable frameworks (GDPR SCCs, as required)

6. Operational Security

6.1 Access Management

Employee access follows the principle of least privilege
Access to production systems requires MFA and is granted on a need-to-know basis
Employee offboarding includes revocation of all system access

6.2 Logging & Monitoring

Audit logs: the platform records every change to client data (create, update, archive, transfer, upload, share) with the user, firm, target record, IP address and time. Sign-in, sign-out, password and MFA changes, role changes and impersonation are recorded in the authentication audit log. Generated documents have their own change and compliance logs.
Not yet logged: viewing a client record and downloading a document through a signed link. Read and download logging is in development.
Monitoring: AWS Security Hub runs the CIS and AWS Foundational Security Best Practices checks. Application logs go to Amazon CloudWatch and Datadog.
Retention: audit tables in the database have no purge job and are kept with the database. CloudWatch application logs are kept for 30 days.

Planned: AWS CloudTrail, GuardDuty and AWS Config with alerts to an on-call contact, 400-day log retention, and database-level write protection for the audit tables.

6.3 Incident Response

Tactive keeps a written incident response runbook. It defines roles, severity levels, detection sources, containment steps for common incidents, the evidence to collect and a notification matrix.

Detection: monitoring and reports from users, vendors and researchers
Triage: severity classification and response team activation
Containment: steps to limit impact
Eradication: root cause identification and remediation
Recovery: service restoration and verification
Post-incident review: lessons learned and control changes

Our target is to notify affected clients within 72 hours after we confirm an incident that affects their data. Investigation of application events uses the audit logs in section 6.2; investigation of AWS account activity will use CloudTrail when it is enabled.

6.4 Backups & Disaster Recovery

Database backups: Aurora takes one automated snapshot per day and keeps a continuous backup. The database can be restored to any second in the last 7 days.
Encryption: backups use the same KMS key as the database.
Location: backups are stored in us-east-1. There is no copy in a second region today.
Documents: production S3 buckets keep prior versions of changed and deleted objects.

Planned: 35-day backup retention, deletion protection, a copy in a second region, and a documented, repeated restore test. Tactive does not publish recovery point or recovery time targets until these controls are in place.

7. Vendors & Sub-processors

The vendors below receive data from the platform. Data Processing Agreements (DPAs) and zero-data-retention terms are being confirmed with each vendor.

Vendor	Purpose	Data received
Amazon Web Services	Hosting, database, storage, text extraction (Textract), email receiving	All platform data
OpenAI	AI models: financial plans and proposals, document classification and extraction, meeting preparation, call transcription	Prompt content with client data, document text, call audio
Anthropic	AI models: chat assistant, compliance checks, market commentary	Prompt content with client data, chat attachments
Voyage AI	Search embeddings and ranking	Text passages from documents, notes and transcripts, with the client name
Datadog	Logs and browser session monitoring	Server logs, advisor browser sessions
GoHighLevel	CRM	Contact details, notes, tasks, appointments, messages, call recordings
Capital Preferences	Behavioral risk assessments	Name, email, date of birth, income, retirement age
Black Diamond (SS&C)	Portfolio data	Tactive reads portfolio data; no client data is written there
DocuSign	E-signature	Name, email, address and date of birth on account forms
Zoom	Meeting recordings and transcripts	Meeting content
Resend	Outbound email	Recipient name and email, email body
Meta	Marketing attribution on public lead forms	Hashed email, phone and name of leads
PostHog	Analytics on public lead forms	Lead id, email and name of leads

8. Employee Security

Background checks are conducted for all employees with access to production systems
Security awareness training is mandatory during onboarding and refreshed annually
All employees sign confidentiality and acceptable use agreements

9. Physical Security

Tactive operates as a cloud-first organization. Physical security controls are inherited from AWS:

AWS data centers maintain SOC 2, ISO 27001 and FedRAMP certifications
AWS controls physical access to its data centers with multiple authentication factors and 24/7 monitoring

10. Penetration Testing & Vulnerability Management

External penetration tests are conducted annually by independent third-party firms
Dependabot reports vulnerable dependencies on the code repository
Critical vulnerabilities are triaged and remediated within 24 hours
High-severity vulnerabilities are patched within 7 days

11. Client Security Controls

Tactive gives firms these security features:

Single sign-on: SAML or OIDC with your identity provider, set up by Tactive on request
Multi-factor authentication: each user can turn on MFA in Settings > Security. Firm-wide enforcement is in development.
Roles and teams: firm owners and admins decide who sees which clients
Audit log: firm owners and admins can view the firm's change log in Settings > Audit log
Data export: individual documents, generated PDFs and portfolio reports can be downloaded. A full per-client export is in development; until then, Tactive provides one on request.

12. Regulatory Alignment

The platform is designed for financial advisory firms:

SEC/FINRA: the audit trail and record retention support FINRA Rule 4511 books-and-records requirements. Audit records are stored in the platform database; they are not yet on write-once (WORM) storage as SEC Rule 17a-4 requires for broker-dealer records.
State privacy laws: in addition to CCPA, Tactive monitors new state privacy laws.

13. Contact & Reporting

For security questions, audit requests or to report a vulnerability:

Email: security@tactive.com
Responsible disclosure: we welcome reports from security researchers. Send details to security@tactive.com.

Tactive reviews this document when a control in it changes, and at least once a year. The current version is always at this URL.