Table of Contents
Who this applies to
This applies to any user who uploads documents through the Business Context feature — including board decks, value creation strategies, scorecards, and other sensitive portfolio materials.
AI processing and data usage
When Entromy processes your documents using AI, the content is used solely to generate insights for your account.
⚠️ Important: Your documents are never used to train, fine-tune, or improve any AI model — including third-party models. Processing happens in isolated sessions and document content is not retained by AI providers beyond the immediate processing window.
Client data segregation
Every client's data is logically isolated within Entromy's infrastructure. Documents uploaded by one firm are never accessible to another.
This segregation is enforced at three layers:
Application layer — access is scoped to your account only
Database layer — data is partitioned by client
Access control layer — permissions are strictly enforced at every level
Fund A's strategy deck is never visible to Fund B, under any circumstances.
Encryption
All uploaded documents are encrypted using strong cryptography aligned with NIST SP 800-57 standards. This applies at every stage:
During upload
While stored on Entromy's servers
Throughout AI processing
Entromy also maintains robust cryptographic key management processes covering the full lifecycle of keys — from generation through rotation and retirement.
Access controls
Information is classified by sensitivity and business criticality. Access to your documents is strictly limited to authorized personnel, governed by Entromy's Access Control Policy.
Entromy is built on secure-by-design and privacy-by-design principles, with least privilege access enforced across all systems and minimal attack surfaces by design.
Data retention and deletion
You stay in control of your documents at all times.
Uploaded files can be deleted at any time from within your account
Deletion is permanent — Entromy does not retain copies after deletion
Data is held only as long as needed to deliver value to your account
✅ Tip: If you need to remove documents after a project is complete, you can do so directly from the Business Context section of your account.
Compliance standards
Entromy's security program aligns with the following recognized standards:
ISO 27001:2022
GDPR
US data privacy requirements
Continuous monitoring
Security controls are regularly monitored and measured using automated tooling to ensure they remain effective over time. Controls are not static — they are reviewed and updated as part of Entromy's ongoing security program.
Where to learn more
For a deeper look at Entromy's security policies, visit trust.entromy.com to review and download:
Cryptography Policy
Secure Development Policy
Data Management Policy
Information Security Policy
Related Articles