Your portfolio data never leaves your machine. Nothing is sent to us, so there is no copy on our side to breach or subpoena. This page lays out exactly how that works, plus our release controls, backup behavior, and implementation evidence, in plain language you can forward straight to IT, compliance, accounting, or management.
This page describes how the product is designed as of November 2026. The Terms of Service are the contract.
Do you have SOC 2? Not yet, and local-first changes the question: we never hold your portfolio data. It stays on your machine, encrypted, under your IT controls, and the only things that reach our servers are license and billing details and security logs.
We hold none of your portfolio data. Your ledger lives in an encrypted database on your own machine, and the installer is a standard signed Windows program. If our license service ever stopped answering, your installed copy would keep working until its license period and offline grace period run out, up to 21 days after its last successful license check, and would then stay read-only. Paused means read-only, not locked out. You can still open and view your records, export an encrypted backup, export the audit log, and download stored documents. Your records stay on your machines and stay readable there in read-only mode. Restoring a backup on any computer needs an active license, so keep the original computer until you have exported what you need.
The installed software keeps your holdings, CUSIPs, imported data files, GL balances, reports, and backups on your own systems, fully under your control. Our website only handles signing up, your license, downloading the software, support requests, and documentation, never your portfolio data.
Six areas your reviewers will probe, and where we stand on each, stated plainly.
Holdings, CUSIPs, source import files, GL balances, and report packages stay on your machine in an encrypted local database. We never receive, store, or transmit your portfolio data, so there is no copy on our side that can be breached, subpoenaed, or go down. Support starts with logs, screenshots, versions, and reproduction steps, never your confidential source files.
Your data is encrypted on your own machine, with encryption keys protected by the operating system. The app checks permissions before every change (the read-only view cannot change anything), keeps a tamper-evident audit log of activity, verifies imported files and backups, and keeps billing and license information separate from your financial data. The desktop app has one operator sign-in per computer today, so it does not enforce separate named roles or two-person approval.
Every production download is code-signed under publisher GRANITE HALL SOLUTIONS LLC, published with a SHA-256 checksum you can verify before install, and tied to a versioned release manifest and a published SBOM. Your IT team can confirm the signature and checksum independently. Nothing on this page requires you to take our word for it.
Automatic and manual restore points are taken on-device, each with an integrity hash and a pre-restore safety snapshot so a restore-point rollback does not start without a safety copy. Every restore-point rollback produces a dated, hashed record you can hand an examiner as evidence that a restore was run.
Your team should come out of the evaluation with a list of your data files, your import mapping, its own check that the numbers balance, a sample support request, a dated record of a backup restore it ran, notes on how licensing works, and its own summary of where the software fits your needs and any gaps.
Online loan applications are not yet available. When they are, they will be kept completely separate from the desktop software and held to stricter standards, including secure document storage, malware scanning, separation between institutions, data-retention controls, electronic-signature (E-SIGN) records, and legally reviewed borrower workflows.
Outbound HTTPS (port 443) from each install machine to fi-investment-tracker-api.fly.dev is the only network access the software needs. No inbound ports, no VPN. First activation requires internet from the install machine; after that the app runs offline for up to 21 days between license checks (14-day license validity plus a 7-day offline grace period). Air-gapped networks are not supported. System requirements: Windows 10 or 11, 64-bit.
Checkout is self-serve and unlocks the signed installer immediately. Verify the checksum, import a real portfolio, and run a full month-end close, all on your own machine, with nothing sent to us. To evaluate with the smallest commitment, pick monthly billing and cancel before the next month if it is not a fit; payments are not refunded for change of mind. The defect guarantee covers a genuine, verified defect that stops you from using what you paid for. Your data stays on your machine either way.