How we handle your documents

You're asking us to hold your side letters and capital account statements, documents that are confidential between you and your GPs. This page states plainly what we actually do, not what we aspire to. If something below turns out not to hold up, tell us and we'll fix the page or the product, whichever is wrong.

What we keep from your documents

When you upload a side letter or capital account statement, we store the structured fee terms and figures we extract -- that's what powers your ongoing fee tracking across quarters. We do not keep the raw document text beyond what's needed to debug a failed extraction: if extraction succeeds, the raw text is never retained at all; if it fails, we keep it only long enough to fix the problem, and it's automatically purged after 14 days.

Your data never crosses into another client's view

Every client's portfolio is scoped server-side to that client and the account that owns it. One user can never read, compare, or export another client's or another firm's data through the product -- including through side-by-side comparison tools, which only ever compare funds within your own portfolio, never across different Verolis clients.

How AI processing works

Document extraction and analysis run through Anthropic's and DeepSeek's standard API services, not their consumer chat products. Under each provider's published API terms, inputs and outputs sent through the API are not used to train their models by default. We're formalizing this into signed data processing terms with each provider; ask us for the current status if it matters for your diligence.

Training our own models is opt-in, off by default

We may want to use real documents to improve our own extraction accuracy over time. That only ever happens if you explicitly turn it on in Account settings. It's off for every new account by default, has no effect on your access to the product either way, and you can turn it off again at any time.

Who inside Verolis can see your data

Administrative access is restricted to a short, explicit allow-list of team email addresses, enforced at the API level on every request -- not a role you can be mistakenly granted, and not the default for anyone on the team.

What we're still building

·SOC 2 Type II -- not yet started, no committed date. We'll update this page when that changes.
·Signed data processing addendum (DPA) -- available on request today for institutional onboarding; not yet a self-serve document.
·Formal data processing agreements with Anthropic and DeepSeek confirming API-tier, no-training terms in writing -- in progress.

Need a DPA or want to walk through data handling before onboarding your firm? Ask us directly, we'll work it out before you upload anything.

Get started