Security and data
What it can touch, and where your files go.
The answers to settle before you send a file or give it a login.
Before you send a file (the free diagnosis)
- Agreement
- We sign a mutual NDA with you before you send anything.
- How files arrive
- Through a private upload link to Bearwall’s Cloudflare R2 storage, sent to you after the first call. Not by email, and there is no upload form on this site. Never passwords or keys.
- Where they sit
- In Bearwall’s Cloudflare R2 storage, encrypted at rest.
- Who sees them
- Fateen Majumder only. Exports are analyzed with Claude (Anthropic).
- How long
- Deleted from Bearwall’s storage automatically 30 days after upload.
- If something goes wrong
- We tell you within 72 hours of finding a breach that touches your files.
When it runs at your company
- Where it runs
- On its own Windows computer at your company, under its own login and key in your system. Screen control runs only under that login; it never takes over a person’s desktop.
- What it needs
- Its own Windows login, and its own login and API key in your system (on RFMS, the exact permissions for its seat are confirmed during the diagnosis). Your people enter them during setup, and each key is checked live before it is saved. You can revoke any of them at any time, and it can no longer write.
- What it can write
- We set up each write type with you, one at a time: bills, bookings, cash receipts, supplier invoices, supplier payment records and schedule dates. Approval cards and its permissions in your system limit what it can write.
- Gated portals
- Only if you want it there, after each portal’s terms are checked with you. A person at your company signs in to the bank, remittance, builder or supplier portal and approves the session. Each portal is scoped in the diagnosis; once set up, it downloads remittances and statements, and its postings and matches are checked like every other write. Your passwords and MFA codes stay with you.
- Never given
- Your people’s passwords or MFA codes, card numbers, or the right to change supplier bank details. It never sends money. We set up its login with you so it cannot delete records or close a period, where your system’s permissions allow.
- Approvals
- Bill and undo runs wait on an approval card that checks the role, as a guard against mistakes. It does not send email, commit in builder portals or close a period.
- Run note
- In the demo, each run keeps a run note listing every write and its read-back result, and the simulated RFMS also keeps one audit row per write. On your system, the run note is set up with the first function.
- Stop
- One Stop command shuts it down on its computer. Revoke its key and it can no longer write.
- When your system changes
- Set to stop and tell a person when a screen or a field does not match what it expects. It does not guess. On RFMS, we aim to adapt within 5 business days.
- Open conversation
- Bill-ready, A/R, A/P and the morning board, which shows back charges and this week’s schedule, are answered by code with no model call. Open conversation uses a model under your own Anthropic account and stays off until you turn it on. It is not offered on production machines until its permissions are tightened.
Who else touches data
| Vendor | What for | When |
|---|---|---|
| Cloudflare | Serves this website | Always, for this site only |
| Cloudflare R2 | Stores diagnosis exports, encrypted at rest | Only if you send exports; deleted automatically 30 days after upload |
| Esri | Map tiles for the on-screen Stage map | Only when the Stage map is open; requests map tiles for the area shown |
| OpenStreetMap (Nominatim, OSRM) | Address lookup and drive-time estimates | Only when a map or scheduling lookup runs; sends the address being looked up |
| Hugging Face | Downloads the local speech and voice models | Once, at install; no company data is sent |
| Anthropic | Analyzes diagnosis exports with Claude; open conversation, under your own Anthropic account | Diagnosis: only if you send exports. Open conversation: only if you turn it on |
| TypeSafe, ElevenLabs | Optional judgment and voice services the engine can use | Off by default; only with your consent |
Hearing and speaking run on the machine itself, offline, with no vendor. Privacy for this website: /privacy/.