Open demo →

SALY TRUST CENTER

Clear controls. Honest boundaries.

See how Catalyst Innovations protects SALY, what is operating today, and what must be completed before customer financial data is accepted.

Last reviewed August 8, 2026Synthetic demonstration only
01

Accounting integrity

Official totals are deterministic. AI cannot approve, post, close a period, or alter approved accounting history.

02

Tenant isolation

Every tenant-owned table is protected by row-level policies and same-organization relationship checks.

03

Evidence over claims

SALY does not claim a provider, recovery exercise, or independent review is ready until current evidence exists.

SECURITY

Defense in depth

  • Access: tenant-scoped authentication, role-based permissions, last-owner protection, and two-person approval by default.
  • Accounting: append-only posted events, balanced journal controls, closed-period protection, and corrections through reversal or adjustment.
  • Documents: private tenant paths, PDF signature and size validation, duplicate hashing, and a quarantine-first malware boundary.
  • AI: untrusted-document isolation, structured outputs, confidence and exception visibility, deterministic arithmetic, and mandatory human review.
  • Operations: bounded health evidence, incident timelines, cost ceilings, recovery targets, and controlled evidence registers.
No certification claimSALY is designed for SOC 2-ready evidence collection but is not represented as SOC 2 certified. An independent penetration and abuse review remains required.

PRIVACY

Purpose-limited data use

  • Customer documents are used only to provide the customer’s SALY workspace and are never used to improve another customer’s results.
  • The public demo uses fictional data and does not accept arbitrary document uploads.
  • Demo analytics exclude invoice content, document text, and free-form financial notes.
  • Data exports and deletion requests require an authenticated administrator, durable evidence, legal-hold checks, and a cooling-off period.
  • Communication consent is separate from account verification or product access.
Legal review pendingThis summary states the current product design; it is not a final privacy notice or contractual commitment.

RETENTION

Proposed defaults

Financial records and audit evidence7 years after the relevant fiscal year; configurable upward
Rejected or unposted invoice drafts90 days after an approved deletion request, unless held
Security logs1 year where the selected service tier supports it
Anonymous demo sessions24 hours
Aggregated, non-sensitive demo analytics13 months

Final retention terms must be included in the customer agreement and reviewed before a customer pilot.

SUBPROCESSORS

Current and planned providers

SupabaseStaged database, authentication, tenant authorization, and private development storage
OpenAI SitesPublic demonstration application hosting
Microsoft AzurePlanned customer document storage and extraction; not activated
Email providerNot selected; outbound delivery remains disabled

Provider purpose, location, contractual terms, and change-notice language require legal confirmation before customer data.

SERVICE STATUS

Current product boundary

Status is intentionally specific: an internal or synthetic check is not presented as proof that an external provider is healthy.

Public demonstrationSynthetic, cached experience; no customer uploads or autonomous accounting actions.

Operational

Customer workspacesAuthentication and tenant controls are staged; customer financial data remains blocked.

Pre-pilot

Invoice extractionSynthetic benchmark results only. Paid OCR and AI providers are not enabled for customer documents.

Not activated

Invitation deliveryInvitations can be prepared and audited, but outbound email delivery is disabled.

Not activated

Commercial billingNo checkout, recurring charges, or customer-controlled paid entitlements.

Disabled

PILOT SUPPORT TARGETS

A defined response path

These are internal pilot targets, not a contractual service-level agreement.

Critical1 hour

Cross-tenant exposure, corrupted posted totals, or an unavailable close.

High4 business hours

Approval, depreciation, export, or sign-in is blocked.

Normal1 business day

Nonfinancial display issue, question, or enhancement.

TERMS BOUNDARY

No customer agreement is implied by this demonstration.

SALY’s public demo is provided for evaluation using fictional data. Visitors must not submit confidential, personal, customer, or regulated information. Paid service, warranties, support commitments, data-processing terms, privacy rights, acceptable-use rules, and liability provisions will be governed only by a separately approved written agreement with Catalyst Innovations.

Formal privacy and terms documents require legal review before contracting or accepting customer data.