26 AI Agents Handling LP Data. Here Is How We Protect It.

Complete database-level isolation per firm. Each fund's LP data, investor records, communications, and documents exist in entirely separate data stores. No agent can access data across firm boundaries. All data access is logged with firm identifiers, and isolation persists across all 26 agent handoffs. The infrastructure has zero public exposure with no ports, login pages, or attack surface visible to the internet.

Every agent action is logged in a SOC 2 style audit trail: which agent accessed which LP data, when, with what output, and whether a human approved it. All entries are cryptographically chained via SHA-256, making the log tamper-evident. Agent 14 (Compliance Review) gates all external communications for Marketing Rule compliance. Monthly compliance posture reports and weekly deep security audits provide continuous documentation for regulatory examination readiness.

No. AssetBoxx runs on dedicated infrastructure that is never shared with other firms. Contractual data processing agreements with all AI providers explicitly prohibit training on your data. Your fund data, LP records, and investor communications never enter any training pipeline. The entire system is invisible to the internet with zero public exposure.

The cryptographic audit trail provides a complete, tamper-evident record of every action taken across all 26 agents. For any LP interaction, you can trace backward from the final communication to the data sources consulted, the compliance checks performed, and the human who approved it. Monthly compliance posture reports provide ready-made documentation. The system is designed from the ground up for SEC examination readiness.

Every LP-facing communication passes through two gates before sending. First, Agent 14 (Compliance Review) checks for SEC Marketing Rule compliance, proper disclaimers, and performance claim validation. Then the approved draft goes to a human reviewer who sees the full content, recipient, fund context, and compliance status. Approve, Edit, or Reject. No code path bypasses this for external communications. LP quarterly letters, investor emails, capital call notices, and marketing content all require both compliance and human approval.

All performance data is sourced from verified systems of record, never generated by AI. The compliance gate validates any numerical claims against source data. Human review provides a second layer of defense. When you edit or reject a draft, corrections feed into the agent's memory for continuous improvement. No performance figure reaches an LP without passing through compliance review and human approval.

All credential-bearing files are permission-locked. Configuration drift is monitored against SHA-256 baselines and any unauthorized changes trigger immediate alerts. Weekly deep security audits scan for credential exposure, dependency vulnerabilities, and access control integrity. No API keys are hardcoded; all secrets are externalized and loaded at runtime.

No. Each of the 26 agents has fixed permissions set at deployment. No agent can expand its own access, grant permissions to another agent, or modify security configurations. The Research Writer cannot send emails. The LP Relationship Agent cannot access other firms' data. Permissions are enforced at infrastructure level, not through prompt instructions an AI might ignore.