Your information, locked down. No fluff.
We're your manager — and we guard what's yours the way we'd guard our own: locking down hard the few things whose theft would actually hurt you, and not hoarding what we don't need.
What we already do today
Your bank, without touching your keys
The bank connection runs through Plaid — the same service thousands of US apps use. We never see or store your bank username or password: just read-only access to what you authorize, and you can cut it off whenever you want.
Everything travels encrypted
Every piece of data between your browser and us goes over an encrypted connection (TLS). No one in the middle reads it.
We collect the minimum
We don't ask for what we don't need, and we don't keep what's no longer needed. Less data stored, less that can be lost.
Nothing critical runs behind your back
Nothing is filed with the IRS without your OK
Every filing or submission to the IRS is approved by you first. We prepare it; you give the green light; and only then is it sent. We never file anything in your name on our own.
We comply with what actually applies
What genuinely applies to a non-resident LLC — like FBAR and BEA. BOIR is no longer required (see FinCEN), and we don't charge you for filings you don't need.
Nothing big executes without a second look
Payments and important operations above a certain threshold go through a human review before they execute. Anything that moves real money gets a person's eyes first.
Technical controls, in detail
Your session can't be stolen from the browser
The session cookie is HttpOnly (unreachable by third-party JavaScript), Secure (never travels unencrypted), and SameSite (protected against cross-site attacks). There's no way to read it from a script injected into the page.
Every action that changes something checks where it came from
Every request that modifies data validates its origin before running — if it doesn't match or is missing, it's rejected. Stops attempts to make you execute actions without noticing.
Limits against brute force
Login, two-factor verification, and public forms have per-IP/per-account attempt limits — they stop automated abuse before it gets anywhere.
A record of who did what
Sensitive admin actions land in an append-only audit log — who, what, and when.
Encryption at rest, where it actually matters
AES-256 encryption on the most sensitive fields: partner tax identifiers, bank connection data, information tied to certain international filings. The rest of the database is protected by access controls — we don't claim universal encryption where it doesn't exist.
Daily backups, restore already tested
Daily server-level backup, with restore verification already tested (data integrity, the app booting from the copy) — it's not just "we back up," it's "we know it works."
Who else touches your data
Only the providers strictly necessary for the service — each with a scoped role, none with access beyond what it needs.
Plaid
Read-only bank access — never holds credentials, never able to move money.
Mercury / Wise
The LLC's own bank accounts (Manager plan) — not a third party's.
Email provider
Transactional sending only: confirmations, reports. No mass marketing with your data.
Groq / Google Gemini (Lucy)
Lucy, your Manager-plan assistant, generates its analyses with external AI models (Groq and Google Gemini). They receive the financial data each analysis needs — never your bank credentials, which we don't hold either.
Revocation and your rights
Disconnect your bank whenever you want
Self-service from your panel: revoke Plaid's access to your bank account at any time.
Delete your bookings
Self-service: request deletion of your scheduled bookings — the most sensitive data (notes, transcripts) is erased immediately, and your remaining personal identifiers are purged after the 30-day audit window.
What we DON'T promise
That no one will ever try — no one can promise that honestly. What we do promise: that what truly matters is protected and that we keep little.
Want to check the authenticity of a document we handed you? You can verify it yourself at devil.club/verify — SHA-256 hash and timestamp, no need to take our word for it.
Questions about how we protect your data? Write to [email protected].