Privacy Policy

Provenance XL, Inc. ("Provenance," "we," "us," or "our") operates a trust layer for financial workflows: version control, review, and AI-assisted checking for Excel models, PowerPoint decks, and the deal documents behind them. This Privacy Policy describes what we collect, why, where it is stored, who else processes it, how long we keep it, and the choices you have.

It covers the Provenance web console, the Provenance Excel and PowerPoint add-ins, our API, our Model Context Protocol (MCP) connector, and our Slack and Microsoft Teams apps (together, the "Service"). It does not cover third-party services you choose to connect, which are governed by their own policies.

Deal information handled in Provenance is frequently material non-public information (MNPI). We design for that: access is granted per deal, not per organization, and our security commitments are described in Section 11 and at provenancexl.com/security.

Provenance is sold to organizations. The law treats the two kinds of data we handle differently, and so do we.

• Customer Content — we are a processor. Workbooks, decks, data-room documents, extracted figures, comments, review decisions, assistant conversations, and anything else you or your colleagues put into a deal workspace. Your organization is the controller. We process this content only on your organization's documented instructions, to deliver the Service. If your organization has signed a Data Processing Addendum (DPA) with us, that agreement governs this content and prevails over this policy where they conflict.
• Account and Usage Data — we are a controller. Your name, work email, profile picture, role, sign-in records, device and connection data, product analytics, support correspondence, and billing records. We use this to run, secure, support, and improve the Service, as described below.

Because your organization controls its workspace, its administrators can see member activity, audit trails, and review histories, and can add, suspend, or remove your access. Requests about Customer Content should generally go to your organization first; see Section 13.

3.1 Account and identity information

• Profile: name, work email address, profile picture, job title where you provide one, and notification preferences.
• Credentials: we do not store passwords. Authentication is handled by Supabase Auth and by your identity provider (Google or Microsoft/Azure single sign-on). We store the resulting identity claims and issue our own signed session cookie.
• Organization and access: your organization, your role (for example owner, admin, member), the specific deals you are seated on, invitations you send or receive, and deactivation records.

3.2 Customer Content you or your organization provides

• Models and decks: Excel workbooks and PowerPoint files you upload, capture from the add-in, or sync from a connected store, plus every saved version, the computed differences between versions, cell-level history, and the notes you write when saving a version.
• Data-room documents: PDFs, spreadsheets, decks, Word documents and similar files you add to a deal, plus text, tables, and figures extracted from them and the links tying a model cell back to its source.
• Collaboration: review requests and rounds, comments and mentions, verification verdicts, decisions to accept, instruct, or reject a change, and review attachments.
• Assistant conversations: the questions you ask the Provenance assistant, the answers returned, and the evidence cited. Saved conversations are scoped to their author and their authorized organization.
• Voice dictation: if you use push-to-talk or live dictation in an assistant composer, the audio you record. See Section 6.4.
• Chat attachments: files you drop into the assistant composer for a one-off question. These are extracted to text in memory to answer the question and are not written to our object storage or database.

3.3 Information collected automatically

• Usage and product analytics: pages viewed, features used, actions taken, counts, statuses, and timings. Analytics properties carry identifiers, types, counts, and statuses only — never cell values, formulas, file contents, document text, or client names.
• Device and connection data: IP address, browser type and version, operating system, and request metadata, used for delivery, rate limiting, and abuse prevention.
• Audit and activity records: an append-only trail of who did what and when inside your workspace — sign-ins, uploads, version saves, review actions, permission changes, data-room imports, and exports.
• Diagnostics: error reports and performance traces. Before an error report leaves your browser or our servers it is scrubbed of workbook bytes, sheet values, formulas, document and OCR text, extracted figures, cookies, authorization headers, tokens, and signed upload/download URLs. Identifiers, counts, statuses, and route names remain.
• Cookies and browser storage: see Section 12.
• Session and presence: which workbook or deck a task pane is connected to and when, so collaborators can see live activity on a deal.

3.4 Information from third parties

• Identity providers: when you sign in with Google or Microsoft through Supabase Auth, we receive the profile claims they release — typically name, email, email-verified status, and a profile picture URL. Where a picture is published in those claims we mirror a copy into our private avatar storage so the Service is not fetching from the provider on every page load.
• Directory provisioning (SCIM): enterprise customers may provision and deprovision users from their identity directory. In that case we receive the user records their directory sends us.
• Organization administrators: your admin may supply your email and intended role when inviting you.
• Connected document stores: if a deal is connected to Google Drive, Microsoft OneDrive or SharePoint, Dropbox, or Box, we receive the files and folder metadata within the scope you authorize. See Section 7.
• Billing: Stripe processes payments and returns subscription status, billing contact, and usage-meter records. Full card numbers never reach our servers.
• Public reference data: for public-company workflows we may retrieve filings and company facts from the U.S. SEC's EDGAR system. These are outbound requests for public data; no Customer Content is sent.
• Gravatar: where an organization explicitly enables it, we may look up a Gravatar image for users without an uploaded picture. This is off by default.

3.5 Guest reviewers

An organization can send a review to someone without a Provenance account through a guest review link. For those recipients we process the email address the sender provided, the actions taken on the link, and a short-lived cookie that keeps the guest session open. Guest access is limited to the specific review it was issued for.

• Provide, operate, maintain, and secure the Service.
• Authenticate you, enforce roles, and enforce per-deal access boundaries.
• Store versions, compute differences between them, extract facts from documents, and produce the audit trail and evidence packages your organization relies on.
• Run review, comparison, and AI-assisted checking workflows.
• Send transactional messages: invitations, review assignments and outcomes, mentions, and account or security notices. We do not send marketing email to workspace members without a separate opt-in.
• Provide support, and investigate and respond to reported problems.
• Understand aggregate usage to prioritize and improve features, using content-free analytics.
• Meter usage, bill subscriptions, and enforce plan limits.
• Detect, investigate, and prevent abuse, fraud, and security incidents.
• Comply with legal obligations and enforce our Terms of Service.

We do not use Customer Content to train, fine-tune, or improve any machine learning model, our own or a vendor's.

Legal bases (EEA/UK). Where GDPR applies and we act as controller, we rely on: performance of a contract (providing the Service and support); legitimate interests (securing the Service, preventing abuse, understanding aggregate product usage, and running our business), balanced against your rights; consent (optional features such as voice dictation, and any marketing communications), which you may withdraw at any time; and legal obligation (tax, accounting, and lawful requests). Where we process Customer Content, we do so as processor on your organization's instructions.

• Structured records — accounts, organizations, deals, versions, diffs, comments, reviews, extracted facts, audit events — are stored in a managed PostgreSQL database in the United States.
• Files — workbooks, decks, data-room documents, review attachments, rendered previews, avatars, and organization logos — are stored in private, S3-compatible object storage in the United States. Buckets are private; the Service hands out short-lived signed URLs (15 minutes by default) rather than public links. Profile pictures and organization logos live in a bucket separate from deal files.
• Backups are encrypted and retained by our infrastructure providers on their standard schedule.
• Application services (API, background workers) run on hardened US cloud infrastructure behind a global edge with automatic TLS and DDoS protection. The web console is served from a global edge network; the API is reached at a single US origin.

We do not currently offer EU or UK data residency. If your organization requires it, contact us before onboarding.

Parts of the Service use AI models. This section explains exactly what is sent where.

6.1 The models we use

Our assistant, document extraction, OCR, review suggestions, and summarization run on Google Gemini models hosted in Google Cloud Vertex AI, under our Google Cloud agreement. Document OCR and layout parsing additionally use Google Cloud Document AI. Under those agreements, Google processes this data as our processor, does not use it to train its models, and does not use it for any purpose other than returning our result.

6.2 What the AI can see

An AI feature only ever receives content the requesting user is already authorized to read. Per-deal access is enforced in our code before a request is assembled, not by the model. A deterministic safety layer additionally blocks an answer that would name or draw on a deal the requester cannot access.

6.3 Web search grounding

One narrow feature can reach the public web: general market and reference questions can be answered with Google Search grounding. It is gated behind a setting, and only questions that have already been classified as not about your deal data are eligible. Deal content, document text, and model values are never sent to web search. Apart from this feature, AI processing does not leave our Google Cloud boundary.

6.4 Voice dictation

Push-to-talk and live dictation send your recorded audio to OpenAI's speech-to-text service through our servers, so that provider credentials never reach your browser, and return a transcript to your composer. Provenance holds the audio only for the duration of the request: it is never written to our database or object storage. Only the transcript you choose to submit is stored, as part of your conversation. The feature is optional, is only shown where it is configured, and is only active while you hold the control. Do not dictate content you would not want transcribed by a third-party provider.

6.5 AI output is advisory

AI-generated review findings, summaries, and answers are advisory. They do not approve, reject, or block anything on their own, and they do not produce legal, financial, or employment decisions about you. Provenance does not use automated decision-making that produces legal or similarly significant effects on individuals within the meaning of GDPR Article 22, and does not use automated decision-making technology for a significant decision within the meaning of the CPRA. Where a version note was drafted by AI rather than written by a person, the record says so.

6.6 Connecting Provenance to an external AI assistant

Your organization can connect Provenance to an external AI client — such as Claude or ChatGPT — through our MCP connector. If you do, that client can read the deal context, version history, diffs, and review state you are authorized to see, and can save a version. Content read through that connector leaves Provenance and is handled by the operator of that AI client under their terms and privacy policy, not ours. This connection is user-initiated and revocable; disconnect it in your AI client or ask your administrator to revoke the grant.

Connecting an external service is your choice, is authorized per user through OAuth, and can be disconnected at any time. Access tokens are stored encrypted.

• Document stores — Google Drive, Microsoft OneDrive and SharePoint, Dropbox, and Box. Connected through Pipedream Connect, which brokers the OAuth connection and file access on our behalf. We import the files and folder metadata inside the scope you grant, and can watch a folder for changes if you ask us to.
• Slack and Microsoft Teams — installed by an organization administrator to deliver review and activity notifications. We store the installation record and the mapping between a Provenance user and their Slack or Teams identity. Notification content is limited to what the recipient is authorized to see.
• Microsoft Office — the Excel and PowerPoint add-ins run inside Office and read the workbook or deck you have open in order to capture a version or run a check. Microsoft's handling of the host application is governed by Microsoft's terms.

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We have not done so in the preceding twelve months. We run no advertising, and we do not permit third-party advertising or cross-site tracking on the Service. We share information only as follows.

• Within your organization: colleagues seated on a deal see that deal's content and the activity on it. Administrators additionally see member activity, audit trails, and workspace settings. Membership in an organization alone does not grant access to a deal.
• With recipients you designate: guest reviewers you send a review link to, and external AI clients you connect (Section 6.6).
• With subprocessors: the vendors listed in Section 9, each bound by a written agreement with confidentiality and data-protection obligations, and each permitted to use the data only to provide their service to us.
• For legal reasons: when required by law, subpoena, or other valid legal process, or where necessary to protect the rights, safety, or property of our users, the public, or Provenance. Where we are legally permitted to do so, we will notify the affected organization before disclosing Customer Content.
• Business transfers: in a merger, acquisition, financing, or sale of assets, information may transfer as part of that transaction. The acquirer remains bound by this policy for the transferred data until it is superseded by notice to you.
• With your consent: for anything else.

These vendors process data on our behalf. The current list is maintained here; we will update it before adding a subprocessor that processes Customer Content.

• Supabase — managed PostgreSQL, authentication, and object storage. United States. Account data and Customer Content.
• Railway — hosting for the API and background workers. United States. Account data and Customer Content in transit and in process.
• Vercel — hosting and edge delivery for the web console and the add-in task pane. Account data and request metadata.
• Cloudflare — edge protection, TLS, and DDoS mitigation for the API. Request metadata.
• Google Cloud (Vertex AI, Document AI) — AI inference, OCR, and document parsing. Customer Content submitted to an AI feature. Not used for model training.
• OpenAI — speech-to-text for the optional voice dictation feature. Recorded audio only, and only when you use it.
• Pipedream — OAuth connection brokering and file access for connected document stores. Connection metadata and the files being imported.
• Stripe — subscription billing and payment processing. Billing contact and payment data; no Customer Content.
• Resend — transactional email delivery. Recipient email address and message content; no Customer Content.
• Sentry — error monitoring and diagnostics. Scrubbed error reports as described in Section 3.3.
• Amplitude — product analytics. Pseudonymous, content-free usage events.
• Slack, Microsoft — notification delivery, where your organization has installed those apps.

To be notified when this list changes, email privacy@provenancexl.com.

We keep information for as long as needed to provide the Service, and then for the periods below. Because Provenance is a system of record, version history and audit trails are deliberately durable: they are what the product is for.

• Customer Content — retained for the life of the deal workspace, and per your organization's configuration. Version history and the audit trail are append-only and are not edited in place.
• Deleted deals and files — removed from the active Service on deletion. Residual copies are cleared from backups within 90 days.
• Deleted organizations — an organization deletion is reversible for 30 days, during which it is hidden from the Service but recoverable. After that window a purge job permanently deletes the organization and its data, and backups age out within a further 90 days.
• Accounts — retained while the account is active. On removal from an organization, access ends immediately and the deactivation is recorded. Attribution on past versions, comments, and audit entries is retained, because removing it would destroy the integrity of the record your organization relies on.
• Voice audio — not retained by Provenance. Held in memory for the length of the transcription request only.
• Chat attachments — not retained. Extracted to text in memory to answer the question.
• Assistant conversations — retained until you or your organization deletes them.
• Diagnostics (Sentry) — retained per our vendor plan, up to 90 days.
• Product analytics — pseudonymous event data retained for trend analysis.
• Email delivery logs — retained to diagnose delivery failures and prevent abuse.
• Billing records — retained as required by tax and accounting law, typically seven years.

We may retain information longer where required by law, or where it is subject to a legal hold or an open dispute or investigation.

• Encryption in transit: TLS 1.2 or higher on every connection, with HSTS enforced.
• Encryption at rest: AES-256 across databases, object storage, and backups. Particularly sensitive credentials — the access tokens for connected Slack, Teams, and webhook integrations, and sign-in hand-off secrets — carry a second layer of application-level encryption with rotatable keys, so they are not readable from a database dump alone.
• Per-deal access barrier: membership in an organization is not authorization. Every request for deal-scoped data is checked against your specific seat on that deal, and every route is enumerated in a ledger that our continuous integration enforces.
• Identity: single sign-on through Google and Microsoft, so your organization's MFA and offboarding policies apply automatically. We do not store passwords. Session cookies are signed, HTTP-only, and Secure in deployed environments.
• Content-free telemetry: analytics and error reports are scrubbed of deal content by design, enforced consistently across the web console, the add-in, and the backend.
• Rate limiting and abuse controls at the edge and in the application.
• Compliance: SOC 2 Type I across Security, Availability, and Confidentiality, with the Type II audit in progress. Controls are monitored continuously. Reports and our DPA are available in our Trust Center.
• Testing: periodic third-party penetration testing and ongoing internal security review.
• Incident response: documented procedures, with notification to affected organizations without undue delay and within the timeframes required by applicable law and by our customer agreements.

No method of electronic storage or transmission is completely secure, and we cannot guarantee absolute security. Report a suspected vulnerability to security@provenancexl.com.

We use no advertising cookies and no cross-site tracking. What we do use:

• Session cookie (essential). A signed, HTTP-only cookie that keeps you signed in. Required for the Service to work; it cannot be disabled while you are using an authenticated part of the Service.
• Guest review cookie (essential). A short-lived cookie issued when you open a guest review link, scoped to that review.
• Office hand-off cookie (essential). Set when opening a file from Provenance into Excel or PowerPoint, to complete the hand-off.
• Preference storage (functional). Non-identifying values in your browser's local storage and cookies that remember your choices — dark mode, deck view mode, assistant panel width — plus the access token and return path used to complete a sign-in.
• Analytics (functional). Pseudonymous, content-free product usage events, described in Section 3.3. We do not use analytics cookies for advertising or profiling.

Your browser can block or clear cookies and local storage, but doing so will sign you out and reset your preferences.

Depending on where you live, you may have the right to access, correct, delete, port, restrict, or object to the processing of your personal information; to opt out of the sale or sharing of personal information and of profiling (we do none of these); to limit the use of sensitive personal information; to withdraw consent; and not to receive discriminatory treatment for exercising a right.

13.1 How to exercise them

• Directly in the product: update your profile and notification preferences, delete your avatar, delete your assistant conversations, and export versions, comparisons, and audit trails from the surfaces where they appear.
• Through your organization: for Customer Content, your organization is the controller. Contact your workspace administrator, who can remove content, revoke access, or delete the workspace. If you ask us directly, we will refer you to them and assist them in responding.
• By contacting us: email privacy@provenancexl.com for anything you cannot do in the product, including deletion of your account. We will verify your identity against the email on your account before acting, and we respond within 30 days (45 days for California requests, extendable once with notice). An authorized agent may submit a request on your behalf with written proof of authorization.

13.2 Limits

Some records cannot be erased on request: entries in an append-only audit trail, and the attribution on saved versions, comments, and review decisions. These exist so an organization can prove who changed what, and deleting them would defeat the purpose of the Service and our customers' own record-keeping obligations. Where we cannot delete, we will tell you why, and we will restrict processing where the law requires.

13.3 California

In the preceding twelve months we collected these categories of personal information: identifiers (name, email, IP address, account and organization identifiers); commercial information (subscription and billing records); internet or network activity (usage, device, and diagnostic data); audio information (voice dictation, if used); professional or employment-related information (employer, role); and inferences drawn only within your workspace from your own content. Sources, purposes, and disclosures are described in Sections 3, 4, and 8. We do not sell or share personal information, and we do not use or disclose sensitive personal information for any purpose beyond those permitted without a right to limit.

13.4 EEA, UK, and Switzerland

You may lodge a complaint with your local supervisory authority. We would appreciate the chance to address your concern first.

We store and process data in the United States. If you access the Service from outside the United States, your information will be transferred to and processed there, where privacy laws may differ from those in your jurisdiction. For transfers from the EEA, UK, or Switzerland we rely on the European Commission's Standard Contractual Clauses (with the UK Addendum where applicable), together with the technical and organizational measures described in Section 11. A copy of the relevant clauses is available on request, and our DPA incorporates them.

The Service is a business tool, is not directed to individuals under 16, and is not offered to them. We do not knowingly collect personal information from children. If we learn that we have, we will delete it promptly.

We may update this policy. When we make a material change, we will update the "Last updated" date above and notify organization administrators by email or in-product notice before the change takes effect. Your continued use of the Service after the effective date constitutes acceptance of the revised policy. Prior versions are available on request.

• Privacy requests and questions: privacy@provenancexl.com
• Security reports: security@provenancexl.com
• General support: support@provenancexl.com
• Data Processing Addendum, SOC 2 report, and subprocessor notifications: Trust Center

Provenance XL, Inc., United States.