Trust
What to check before you trust us with a fund.
The answers a CFO, an IT reviewer or a compliance officer asks for, in one place: where your data sits and who can see it, what the AI may do with it, how the records hold up, and what we do not have yet.
Your data
Isolated, kept exactly, and yours to take.
Isolated by design
Every table carries row-level security by client. Within a client, rights are given fund by fund, and an investor sees only their own positions.
Originals kept exactly
Each document is retained byte for byte with its SHA-256 hash and encrypted with AES-256-GCM. Keys are kept outside document storage and can be rotated.
Backups that prove themselves
Backups verify every encrypted source against its hash; a restore checks fingerprints and closes existing sessions.
Where it lives
Agreed with each client before any real data is loaded. The demonstration runs on synthetic data only.
Yours to take
Ledgers, capital accounts and the audit trail export to Excel, and the auditor pack carries the documents with their hashes.
AI and your data
Local by default, on record, never in charge.
Local by default
The agents run on a local model. Nothing goes to a hosted model unless your own data policy allows it.
Every call on record
Each model call keeps its versioned instructions and what the model was shown, so it can be replayed and proved.
Read-only and measured
Agents never post or approve. They act only above a measured quality threshold, tested against documents written to manipulate them.
Access and integrity
The right people, and records that cannot be quietly changed.
A second factor for approvers
Time-based codes with single-use recovery codes. Anyone who can approve must enrol before approving anything.
Four eyes on every write
Whoever prepares cannot approve or post. Two people are always enough.
A signed, verifiable trail
Each event is chained and signed with HMAC-SHA-256 under a key held outside the database, and can be checked against a checkpoint you keep.
Sealed reports
Oversight reports are frozen when prepared, sealed by their SHA-256 and, when a timestamping authority is configured, an RFC 3161 timestamp.
Read-only integrations
Integration tokens are read-only, limited to the funds you choose, stored as hashes and revocable at once.
Assurance
Prepared for ISAE 3402, SOC 2 and DORA reviews.
The controls these reviews examine are built in and produce their evidence as the work happens: a parallel run against your administrator, a controls register shared with your AIFM, administrator and auditor, and an auditor pack with file hashes.
Not yet
What we do not have today.
A SOC 2 or ISAE 3402 report
FundAgent is prepared for these reviews; no audit report has been issued.
An external penetration test report
No independent test report exists yet.
Single sign-on
Accounts use a password and a second factor; OIDC and SAML are not available.
A qualified electronic signature
Reports are approved by name, sealed and timestamped; this is not an eIDAS qualified signature.
Payments or filings made for you
FundAgent prepares payment files and regulatory files; your bank executes, and you submit.
Questions
What people ask first.
Do we have to change administrator?
No. The administrator check works on a fund FundAgent does not administer: their statements, your LPA and the bank statements are enough.
Does our data go to an AI provider?
Not unless your data policy allows it. The agents run on a local model by default, and every call is recorded.
Can FundAgent move money?
No. It prepares ISO 20022 payment files that a second person approves; your bank executes them.
How does a switch work?
Start with the administrator check, run FundAgent beside your administrator for a quarter until every difference is explained, then switch. Opening balances never invent past flows.
Who can see what?
Rights are given per fund. External parties, such as the AIFM’s functions, the administrator or the auditor, see only the controls shared with them; investors see only their own positions.
Which languages?
English and French, in the interface and in investor documents.
What does it cost?
Pricing is on request.
Ask for what your review needs.
Write to us or request a demo: we answer due-diligence questions in writing.