Privacy Policy

Provenance XL, Inc. ("Provenance," "we," "us," or "our") operates a trust layer for financial workflows: version control, review, and AI-assisted checking for Excel models, PowerPoint decks, and the deal documents behind them. This Privacy Policy describes what we collect, why, where it is stored, who else processes it, how long we keep it, and the choices you have.

It covers the Provenance web console, the Provenance Excel and PowerPoint add-ins, our API, our Model Context Protocol (MCP) connector, and our Slack and Microsoft Teams apps (together, the "Service"). It does not cover third-party services you choose to connect, which are governed by their own policies.

Deal information handled in Provenance is frequently material non-public information (MNPI). Access is set by organization: every member of your organization can read every deal in it. People outside your organization cannot, except guest reviewers, who see only the review they were sent (Section 3.5), and people a member shares a comparison with, who see only that comparison, including the versions it compares, for seven days. Provenance does not restrict any member's access to particular deals, so it does not provide an information barrier between teams inside your organization. Our security measures are described in Section 11 and at provenancexl.com/security.

Provenance is sold to organizations. The law treats the two kinds of data we handle differently, and so do we.

• Customer Content: we are a processor. Workbooks, decks, data-room documents, extracted figures, comments, review decisions, assistant conversations, and anything else you or your colleagues put into a deal workspace. Your organization is the controller. We process this content only on your organization's documented instructions, to deliver the Service. If your organization has signed a Data Processing Addendum (DPA) with us, that agreement governs this content and prevails over this policy where they conflict.
• Account and Usage Data: we are a controller. Your name, work email, profile picture, role, sign-in records, device and connection data, product analytics, support correspondence, and billing records. We use this to run, secure, support, and improve the Service, as described below.

Because your organization controls its workspace, its administrators can see member activity, audit trails, and review histories, and can add, suspend, or remove your access. Requests about Customer Content should generally go to your organization first; see Section 13.

3.1 Account and identity information

• Profile: name, work email address, profile picture, job title where you provide one, and notification preferences.
• Credentials: we do not store passwords. Authentication is handled by Supabase Auth and by your identity provider (Google or Microsoft/Azure single sign-on). We store the resulting identity claims and issue our own signed session cookie.
• Organization and access: your organization, your role (for example owner, admin, member), the deals you are listed as working on, invitations you send or receive, and deactivation records.

3.2 Customer Content you or your organization provides

• Models and decks: Excel workbooks and PowerPoint files you upload, capture from the add-in, or sync from a connected store, plus every saved version, the computed differences between versions, cell-level history, and the notes you write when saving a version.
• Data-room documents: PDFs, spreadsheets, decks, Word documents and similar files you add to a deal, plus text, tables, and figures extracted from them and the links tying a model cell back to its source.
• Collaboration: review requests and rounds, comments and mentions, verification verdicts, decisions to accept, instruct, or reject a change, and review attachments.
• Assistant conversations: the questions you ask the Provenance assistant, the answers returned, and the evidence cited. Saved conversations are scoped to their author and their authorized organization.
• Voice dictation: if you use push-to-talk or live dictation in an assistant composer, the audio you record. See Section 6.4.
• Chat attachments: files you drop into the assistant composer for a one-off question. These are extracted to text in memory to answer the question and are not written to our object storage or database.

3.3 Information collected automatically

• Usage and product analytics: pages viewed, features used, actions taken, counts, statuses, and timings. Analytics properties carry identifiers, types, counts, and statuses only, never cell values, formulas, file contents, document text, or client names.
• Device and connection data: IP address, browser type and version, operating system, and request metadata, used for delivery, rate limiting, and abuse prevention.
• Audit and activity records: an append-only trail of who did what and when inside your workspace: sign-ins, uploads, version saves, review actions, permission changes, data-room imports, and exports.
• Diagnostics: error reports and performance traces. Before an error report leaves your browser or our servers it is scrubbed of workbook bytes, sheet values, formulas, document and OCR text, extracted figures, cookies, authorization headers, tokens, and signed upload/download URLs. Identifiers, counts, statuses, and route names remain.
• Cookies and browser storage: see Section 12.
• Session and presence: which workbook or deck a task pane is connected to and when, so collaborators can see live activity on a deal.

3.4 Information from third parties

• Identity providers: when you sign in with Google or Microsoft through Supabase Auth, we receive the profile claims they release, typically name, email, email-verified status, and a profile picture URL. Where a picture is published in those claims we mirror a copy into our private avatar storage so the Service is not fetching from the provider on every page load.
• Directory provisioning (SCIM): enterprise customers may provision and deprovision users from their identity directory. In that case we receive the user records their directory sends us.
• Organization administrators: your admin may supply your email and intended role when inviting you.
• Connected document stores: if a deal is connected to Google Drive, Microsoft OneDrive or SharePoint, Dropbox, or Box, we receive the files and folder metadata within the scope you authorize. See Section 7.
• Billing: Stripe processes payments and returns subscription status, billing contact, and usage-meter records. Full card numbers never reach our servers.
• Public reference data: for public-company workflows we may retrieve filings and company facts from the U.S. SEC's EDGAR system. These are outbound requests for public data; no Customer Content is sent.
• Gravatar: where an organization explicitly enables it, we may look up a Gravatar image for users without an uploaded picture. This is off by default.

3.5 Guest reviewers

An organization can send a review to someone without a Provenance account through a guest review link. For those recipients we process the email address the sender provided, the actions taken on the link, and a short-lived cookie that keeps the guest session open. Guest access is limited to the specific review it was issued for.

• Provide, operate, maintain, and secure the Service.
• Authenticate you, enforce roles, and keep each organization's data separate from other organizations.
• Store versions, compute differences between them, extract facts from documents, and produce the audit trail and evidence packages your organization relies on.
• Run review, comparison, and AI-assisted checking workflows.
• Send transactional messages: invitations, review assignments and outcomes, mentions, and account or security notices. We do not send marketing email to workspace members without a separate opt-in.
• Provide support, and investigate and respond to reported problems.
• Understand aggregate usage to prioritize and improve features, using content-free analytics.
• Meter usage, bill subscriptions, and enforce plan limits.
• Detect, investigate, and prevent abuse, fraud, and security incidents.
• Comply with legal obligations and enforce our Terms of Service.

We do not use Customer Content to train, fine-tune, or improve any machine learning model, our own or a vendor's.

Legal bases (EEA/UK). Where GDPR applies and we act as controller, we rely on: performance of a contract (providing the Service and support); legitimate interests (securing the Service, preventing abuse, understanding aggregate product usage, and running our business), balanced against your rights; consent (optional features such as voice dictation, and any marketing communications), which you may withdraw at any time; and legal obligation (tax, accounting, and lawful requests). Where we process Customer Content, we do so as processor on your organization's instructions.

• Structured records (accounts, organizations, deals, versions, diffs, comments, reviews, extracted facts, audit events) are stored in a managed PostgreSQL database in the United States.
• Files (workbooks, decks, data-room documents, review attachments, rendered previews, avatars, and organization logos) are stored in private, S3-compatible object storage in the United States. Buckets are private; the Service hands out short-lived signed URLs (15 minutes by default) rather than public links. Profile pictures and organization logos live in a bucket separate from deal files.
• Backups are encrypted and retained by our infrastructure providers on their standard schedule.
• Application services (API, background workers) run on hardened US cloud infrastructure behind a global edge with automatic TLS and DDoS protection. The web console is served from a global edge network; the API is reached at a single US origin.

We do not currently offer EU or UK data residency. If your organization requires it, contact us before onboarding.

Parts of the Service use AI models. This section explains what is sent where.

6.1 The AI providers we use

Parts of the Service send Customer Content to the AI providers below. Which provider receives it depends on the feature, on how we have configured that feature, and, for the assistant, on which model answers the question.

• Google Cloud: Gemini models on Vertex AI for the assistant, summaries, review suggestions, document extraction, and OCR; Document AI for document parsing and OCR; and Vertex AI embedding and ranking services for searching your documents. Under our Google Cloud agreement, Google processes this data as our processor, does not use it to train its models, and does not use it for any purpose other than returning our result.
• OpenAI: the assistant, when an OpenAI model answers a question; document extraction and OCR, where we have set them to use OpenAI; and speech-to-text for voice dictation (Section 6.4).
• xAI: the assistant, when a Grok model answers a question.
• Anthropic: the assistant, when a Claude model answers a question.
• Reducto: document parsing, where we have set document extraction to use it in place of Document AI.

When the assistant answers, the provider of the answering model receives your question, the earlier messages in that conversation, any file attached to the question, details of the workbook or deck you have open when you ask from an add-in, and the deal content the assistant retrieves to answer it, such as model values, version changes, document text, and extracted figures.

6.2 What the AI can see

An AI feature only ever receives content the requesting user is already authorized to read. That check is made in our code, not by the model, before content is passed to the model. Because access is set by organization (Section 1), the assistant can draw on any deal in the requesting user's organization.

6.3 Web search

The assistant can search the public web using Grounding with Google Search on Vertex AI while answering any question, including one about your deals. The assistant model writes each search query itself and is instructed to leave private workspace content out of it, but because the model writes the query, we cannot guarantee that a query never reflects information from your conversation. Google handles search queries under the terms for that feature.

6.4 Voice dictation

Push-to-talk and live dictation send your recorded audio to OpenAI's speech-to-text service through our servers, so that provider credentials never reach your browser, and return a transcript to your composer. Provenance holds the audio only for the duration of the request: it is never written to our database or object storage. Only the transcript you choose to submit is stored, as part of your conversation. The feature is optional, is only shown where it is configured, and is only active while you hold the control. Do not dictate content you would not want transcribed by a third-party provider.

6.5 AI output is advisory

AI-generated review findings, summaries, and answers are advisory. They do not approve, reject, or block anything on their own, and they do not produce legal, financial, or employment decisions about you. Provenance does not use automated decision-making that produces legal or similarly significant effects on individuals within the meaning of GDPR Article 22, and does not use automated decision-making technology for a significant decision within the meaning of the CPRA. Where a version note was drafted by AI rather than written by a person, the record says so.

6.6 Connecting Provenance to an external AI assistant

Your organization can connect Provenance to an external AI client, such as Claude or ChatGPT, through our MCP connector. If you do, that client can read the deal context, version history, diffs, and review state you are authorized to see, and can save a version. Content read through that connector leaves Provenance and is handled by the operator of that AI client under their terms and privacy policy, not ours. This connection is user-initiated and revocable; disconnect it in your AI client or ask your administrator to revoke the grant.

Connecting an external service is your choice, is authorized per user through OAuth, and can be disconnected at any time. Access tokens are stored encrypted.

• Document stores: Google Drive, Microsoft OneDrive and SharePoint, Dropbox, and Box. Connected through Pipedream Connect, which brokers the OAuth connection and file access on our behalf. We import the files and folder metadata inside the scope you grant, and can watch a folder for changes if you ask us to.
• Slack and Microsoft Teams: installed by an organization administrator to deliver review and activity notifications. We store the installation record and the mapping between a Provenance user and their Slack or Teams identity. Notification content is limited to what the recipient is authorized to see.
• Microsoft Office: the Excel and PowerPoint add-ins run inside Office and read the workbook or deck you have open in order to capture a version or run a check. Microsoft's handling of the host application is governed by Microsoft's terms.

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We have not done so in the preceding twelve months. We run no advertising, and we do not permit third-party advertising or cross-site tracking on the Service. We share information only as follows.

• Within your organization: every member of your organization can see every deal in it, including its content and the activity on it. Administrators additionally see member activity, audit trails, and workspace settings.
• With recipients you designate: guest reviewers you send a review link to; people you share a comparison with, who must sign in to Provenance with the email address you shared it to and can open it for seven days whatever organization they belong to; and external AI clients you connect (Section 6.6).
• With subprocessors: the vendors listed in Section 9, to provide their services to us.
• For legal reasons: when required by law, subpoena, or other valid legal process, or where necessary to protect the rights, safety, or property of our users, the public, or Provenance. Where we are legally permitted to do so, we will notify the affected organization before disclosing Customer Content.
• Business transfers: in a merger, acquisition, financing, or sale of assets, information may transfer as part of that transaction. The acquirer remains bound by this policy for the transferred data until it is superseded by notice to you.
• With your consent: for anything else.

These vendors process data on our behalf. The current list is maintained here; we will update it before adding a subprocessor that processes Customer Content.

• Supabase: managed PostgreSQL, authentication, and object storage. United States. Account data and Customer Content.
• Railway: hosting for the API and background workers. United States. Account data and Customer Content in transit and in process.
• Vercel: hosting and edge delivery for the web console and the add-in task pane. Account data and request metadata.
• Cloudflare: edge protection, TLS, and DDoS mitigation for the API. Request metadata.
• Google Cloud (Vertex AI, Document AI): AI inference, OCR, document parsing, and search over your documents. Customer Content submitted to those features. Not used for model training.
• Google Cloud (Grounding with Google Search): public web searches the assistant runs (Section 6.3). The search queries the assistant writes.
• OpenAI: the assistant when an OpenAI model answers, document extraction and OCR where set to use OpenAI, and speech-to-text for voice dictation. Customer Content sent to those features, and recorded audio when you dictate.
• xAI: the assistant when a Grok model answers. Customer Content the assistant sends with that question.
• Anthropic: the assistant when a Claude model answers. Customer Content the assistant sends with that question.
• Reducto: document parsing, where document extraction is set to use it. The documents being parsed.
• Pipedream: OAuth connection brokering and file access for connected document stores. Connection metadata and the files being imported.
• Stripe: subscription billing and payment processing. Billing contact and payment data; no Customer Content.
• Resend: transactional email delivery. Recipient email address and message content; no Customer Content.
• Sentry: error monitoring and diagnostics. Scrubbed error reports as described in Section 3.3.
• Amplitude: product analytics. Pseudonymous, content-free usage events.
• Slack, Microsoft: notification delivery, where your organization has installed those apps.

To be notified when this list changes, email privacy@provenancexl.com.

We keep information for as long as needed to provide the Service, and then for the periods below. Because Provenance is a system of record, version history and audit trails are kept by default: they are what the product is for.

• Customer Content: retained while your organization's workspace exists, and after deletion as described below. The audit trail is append-only and is not edited in place.
• Deleted versions: a version's author or an organization administrator can delete a single version. Unlike the deletions below, this erases it: the version's record, its comments, its computed changes, and its check results are removed from our database, and later versions are re-linked to the version before it. The stored copy of the file stays in object storage while the model it belongs to exists. The audit trail records that the version was deleted and by whom.
• Deleted deals, models, data rooms, and files: deleting one takes it out of the Service's lists and pages right away, and it is erased within 14 days: an automatic purge removes its records from our database and its stored files from object storage, and copies in backups are removed as those backups expire on their normal rotation. An erased item cannot be restored. The append-only audit trail keeps its entries about the item, including that it was deleted and erased.
• Deleted organizations: when an organization is deleted, it and its deals are hidden in the same way, and for 14 days our operators can restore them. After that its deals, with their records and files, are erased as above. The organization's own record (its name, settings, and member list) and its audit trail are kept.
• Accounts: retained while the account is active. On removal from an organization, access ends immediately and the deactivation is recorded. Deleting your account deactivates it, signs you out everywhere, and hides your personal workspace as described above. Within 14 days the sign-in identity held by our authentication provider is deleted, your email address, profile pictures, and the files you uploaded to compare are erased, and your personal workspace's deals are erased as above. Your name stays as the attribution on past versions, comments, and audit entries, because removing it would destroy the integrity of the record your organization relies on.
• Voice audio: not retained by Provenance. Held in memory for the length of the transcription request only.
• Chat attachments: not retained. Extracted to text in memory to answer the question.
• Assistant conversations: retained until you or your organization deletes them.
• Diagnostics (Sentry): retained per our vendor plan, up to 90 days.
• Product analytics: pseudonymous event data retained for trend analysis.
• Email delivery logs: retained to diagnose delivery failures and prevent abuse.
• Billing records: retained as required by tax and accounting law, typically seven years.

We may retain information longer where required by law, or where it is subject to a legal hold or an open dispute or investigation.

• Encryption in transit: TLS 1.2 or higher on every connection, with HSTS enforced.
• Encryption at rest: AES-256 across databases, object storage, and backups. Particularly sensitive credentials (the access tokens for connected Slack, Teams, and webhook integrations, and sign-in hand-off secrets) carry a second layer of application-level encryption with rotatable keys, so they are not readable from a database dump alone.
• Organization access boundary: every request for deal data is checked in our code against your membership in the deal's organization, and every route is enumerated in a ledger that our continuous integration enforces. Within an organization, every member can read every deal.
• Identity: single sign-on through Google and Microsoft, so your organization's MFA and offboarding policies apply automatically. We do not store passwords. Session cookies are signed, HTTP-only, and Secure in deployed environments.
• Content-free telemetry: analytics and error reports are scrubbed of deal content by design, enforced consistently across the web console, the add-in, and the backend.
• Rate limiting and abuse controls at the edge and in the application.
• Compliance: SOC 2 Type I across Security, Availability, and Confidentiality, with the Type II audit in progress. Controls are monitored continuously. Reports and our DPA are available in our Trust Center.
• Testing: periodic third-party penetration testing and ongoing internal security review.
• Incident response: documented procedures, with notification to affected organizations without undue delay and within the timeframes required by applicable law and by our customer agreements.

No method of electronic storage or transmission is completely secure, and we cannot guarantee absolute security. Report a suspected vulnerability to security@provenancexl.com.

We use no advertising cookies and no cross-site tracking. What we do use:

• Session cookie (essential). A signed, HTTP-only cookie that keeps you signed in. Required for the Service to work; it cannot be disabled while you are using an authenticated part of the Service.
• Guest review cookie (essential). A short-lived cookie issued when you open a guest review link, scoped to that review.
• Office hand-off cookie (essential). Set when opening a file from Provenance into Excel or PowerPoint, to complete the hand-off.
• Preference storage (functional). Non-identifying values in your browser's local storage and cookies that remember your choices (dark mode, deck view mode, assistant panel width), plus the access token and return path used to complete a sign-in.
• Analytics (functional). Pseudonymous, content-free product usage events, described in Section 3.3. We do not use analytics cookies for advertising or profiling.

Your browser can block or clear cookies and local storage, but doing so will sign you out and reset your preferences.

Depending on where you live, you may have the right to access, correct, delete, port, restrict, or object to the processing of your personal information; to opt out of the sale or sharing of personal information and of profiling (we do none of these); to limit the use of sensitive personal information; to withdraw consent; and not to receive discriminatory treatment for exercising a right.

13.1 How to exercise them

• Directly in the product: update your profile and notification preferences, delete your avatar, delete your assistant conversations, delete your account, and export versions, comparisons, and audit trails from the surfaces where they appear.
• Through your organization: for Customer Content, your organization is the controller. Contact your workspace administrator, who can remove content, revoke access, or delete the workspace. Section 10 explains what deletion keeps. If you ask us directly, we will refer you to them and assist them in responding.
• By contacting us: email privacy@provenancexl.com for anything you cannot do in the product, including erasure of your account data. We will verify your identity against the email on your account before acting, and we respond within 30 days (45 days for California requests, extendable once with notice). An authorized agent may submit a request on your behalf with written proof of authorization.

13.2 Limits

Some records cannot be erased on request: entries in an append-only audit trail, and the attribution on saved versions, comments, and review decisions. These exist so an organization can prove who changed what, and deleting them would defeat the purpose of the Service and our customers' own record-keeping obligations. Where we cannot delete, we will tell you why, and we will restrict processing where the law requires.

13.3 California

In the preceding twelve months we collected these categories of personal information: identifiers (name, email, IP address, account and organization identifiers); commercial information (subscription and billing records); internet or network activity (usage, device, and diagnostic data); audio information (voice dictation, if used); professional or employment-related information (employer, role); and inferences drawn only within your workspace from your own content. Sources, purposes, and disclosures are described in Sections 3, 4, and 8. We do not sell or share personal information, and we do not use or disclose sensitive personal information for any purpose beyond those permitted without a right to limit.

13.4 EEA, UK, and Switzerland

You may lodge a complaint with your local supervisory authority. We would appreciate the chance to address your concern first.

We store and process data in the United States. If you access the Service from outside the United States, your information will be transferred to and processed there, where privacy laws may differ from those in your jurisdiction. For transfers from the EEA, UK, or Switzerland we rely on the European Commission's Standard Contractual Clauses (with the UK Addendum where applicable), together with the technical and organizational measures described in Section 11. A copy of the relevant clauses is available on request, and our DPA incorporates them.

The Service is a business tool, is not directed to individuals under 16, and is not offered to them. We do not knowingly collect personal information from children. If we learn that we have, we will delete it promptly.

We may update this policy. When we make a material change, we will update the "Last updated" date above and notify organization administrators by email or in-product notice before the change takes effect. Your continued use of the Service after the effective date constitutes acceptance of the revised policy. Prior versions are available on request.

• Privacy requests and questions: privacy@provenancexl.com
• Security reports: security@provenancexl.com
• General support: support@provenancexl.com
• Data Processing Addendum, SOC 2 report, and subprocessor notifications: Trust Center

Provenance XL, Inc., United States.