Evidence-backed capability register

FinanceGPT Trust Center

Security, privacy and assurance information for customer due diligence, with capability status separated from implementation intent.

Certification status: FinanceGPT does not claim SOC 2 attestation or ISO/IEC 27001 certification. Readiness controls and evidence-management features are not a substitute for independently issued attestations or certificates.

Operational

Implemented, represented as usable, and subject to deployment verification.

Configurable

Implemented but requires customer/environment configuration before use.

Preview / Planned

Not represented as generally available production capability.

Not claimed

FinanceGPT explicitly does not make this public claim.

Current capability claims

Surface	Capability	Status	Statement
Institutional Cloud	Private networking	Planned	Private networking is a deployment roadmap capability and must not be represented as generally live until provisioned and evidenced.
Investment Intelligence	Broker trade execution	Not claimed	M25 does not execute securities trades. Investment actions remain analytical or governed proposals.
Trust Center	Hashed API credentials	Operational	FinanceGPT stores governed API credentials using non-plaintext credential handling in the API platform.
Trust Center	HMAC-signed webhooks	Operational	FinanceGPT supports HMAC-signed enterprise API webhooks where the API platform is enabled and configured.
Trust Center	ISO/IEC 27001 certification	Not claimed	FinanceGPT does not claim ISO/IEC 27001 certification in M25.
Trust Center	Microsoft Entra OIDC	Configurable	Microsoft Entra OIDC support is implemented but requires customer and environment configuration before it is operational.
Trust Center	SCIM 2.0 provisioning	Configurable	SCIM token and provisioning controls are implemented and require customer configuration and deployment validation.
Trust Center	Security incident register	Operational	FinanceGPT includes a governed security incident register within the assurance layer.
Trust Center	SHA-256 evidence digests	Operational	Assurance evidence packages and governed records use cryptographic digests where implemented by the relevant evidence service.
Trust Center	SOC 2 attestation	Not claimed	FinanceGPT does not claim a SOC 2 attestation in M25.
Trust Center	Vendor risk register	Operational	FinanceGPT includes a governed third-party/vendor risk register within the assurance layer.

Governance principles

Workspace role-based access and approvals
Data and model lineage where implemented by the relevant subsystem
Separate configuration from externally verified compliance status
Usage metering does not imply automatic billing

Financial action boundary

Investment analysis and governed proposals are supported surfaces
Legacy direct rebalance and tax-harvesting actions remain disabled; governed proposal and execution workflows are used instead
Broker execution is available only through separately governed investment execution connectors and policies
Financial actions and investment execution pass separate governed execution gateways

Capability status is an internal product representation, not an independent assurance opinion. Customers should rely on formally issued third-party reports and certificates where required.