SCRUFFGUARD
AI you can actually trust.
Built-in verification. Full traceability. Complete control.
The Framework
Three pillars of trustworthy AI.
Every piece of data Scruffy touches is governed by a three-part security framework.
Safe
Guardrails aligned to advisory compliance standards. Every output is checked against regulatory requirements before it reaches you.
Secure
TLS 1.2+ in transit, AES-256 at rest in AWS, and role-based access. Client records are stored in Tactive's AWS account and in the CRM and assessment systems your firm already uses (GoHighLevel, Capital Preferences). AI providers receive data only for processing, under API terms that exclude training.
System
Centralized oversight and permissions. Admins control who sees what, with full audit trails.
Compliance Built In
Audit-ready from day one.
Traceable documentation, stored in Tactive's AWS account, designed for advisory compliance.
Confidence Scoring
AI-extracted fields include confidence scores, so you know exactly how reliable each data point is.
Source Traceability
See exactly where each data point came from: the document, page, and field that produced it.
Human Review Workflows
Low-confidence fields are flagged for advisor approval before entering your system.
Audit Trail
Every change is logged: who created, edited, uploaded or approved a record, when, and from where.
No Model Training
Documents and generated plans are stored in Tactive's AWS account. AI providers receive client data only for processing, under API terms that exclude training on it.
Regulatory Alignment
Built to meet SEC, FINRA, and state regulatory requirements.
See verification in real time.
Uploading document...
JamesCaldwell_BankStatement.pdf
Enterprise-grade security and controls
Tactive meets the highest industry standards for security and compliance.
More About SecuritySOC2 II
CCPA
ISO 27001
GDPR
ISO/IEC 42001
The top advisory teams use Scruffy for
Frequently asked questions
Everything you need to know about ScruffGuard and compliance.
Can AI really be trusted with client data?
That's why we built ScruffGuard. Instead of trusting blindly, you verify. Every field, every time. Confidence scores, source traceability, and human review workflows are built in.
Does my client data leave Tactive's systems?
Yes, to named vendors. Records, documents, chat transcripts and generated plans are stored in Tactive's AWS account in the US. Contact and assessment data is also stored in the CRM and assessment systems your firm already uses (GoHighLevel, Capital Preferences), and the other vendors in our Security White Paper (for example DocuSign, Zoom, Resend and Datadog) receive the data their service needs. For processing: to answer a question or write a plan, the platform sends the relevant client data to AI model providers (Anthropic, OpenAI and Voyage AI) and stores the answer. Under their commercial API terms, Anthropic and OpenAI do not train on API data; Voyage AI states that it does not train on customer data. ScruffGuard is the compliance layer: it checks AI output and messages for regulatory problems. It does not stop client data from going to the model providers. The full sub-processor list is in our Security White Paper.
Who at my firm can access client data within the platform?
Access is controlled through centralized permissions. As the admin, you determine who sees what. Team members only access the data you authorize, and every permission change is logged. If you have multiple advisors on your team, you can configure access at the individual level.
How do I prove this to my compliance team?
Every piece of extracted data comes with a full audit trail: who uploaded the document, who reviewed it, who approved it, and when. Export-ready for compliance reporting.
