Security first
Built by people who secure advisory firms for a living.
Valdivia Solutions does cybersecurity and IT for independent advisors. AdvisorOS is held to the same standard we hold our clients to. Here's how it works, and what your CCO can request.
Your data, walled off
Every table is locked to its advisor with database row-level security. One firm can't read another's records, even through the API.
AI keys stay on the server
If you connect your own AI provider key, it's used server-side only. It never reaches the browser and is never written to the audit log.
Prompts aren't kept
AdvisorOS logs a hash of each AI prompt and output, not the text, because prompts can contain client notes.
Encrypted in transit and at rest
HTTPS everywhere with strict transport security.
Sign-in protection
AdvisorOS provides multi-factor authentication (MFA) to protect your sign-in.
If something goes wrong
We notify affected firms within 72 hours of learning of a breach that affects their data, so you can meet your own Reg S-P obligations.
Where your data goes
| Provider | What for | Data involved |
|---|---|---|
| Vercel | Hosts the AdvisorOS app | Requests in transit |
| Supabase | Database, sign-in and file storage | All practice data |
| OpenAI / Claude | Drafting | The prompt for each draft |
Full list and changes: sub-processors.
Request the due-diligence packet
Everything your CCO needs for vendor oversight, in one email.
- Security overview and architecture
- Sub-processor list
- Data processing agreement
- Incident response and breach notice summary
- Audit log and AI provenance description
Email us for the packet
Send a short note with your name, firm and role, and we'll reply with the packet.
Request the packet by emailOr write to peterj@valdiviasolutions.com