Live demoExplore a synthetic sample deal, from source files to a draft credit memo.
Try the demoSecurity
A financial package deserves more than “bank-grade security”. Here is exactly who can see yours, where every byte goes, and how deletion works.
Protected by default
Each protection below is built into the workspace, and automated tests check it on every change. The scenes are illustrative; the behaviour is real.
The workspace checks your verified sign-in on every request. Someone else asking for your deal gets the same answer as for a deal that doesn’t exist.
GET /api/deals/7f3a200 OKGET /api/deals/7f3a404 Not foundIllustrative requests. Same deal, two accounts.
We don’t train models on your files. Cloudflare’s terms say it won’t either, and every model call asks it not to store the request.
// sent with every model call
{ store: false }Deals never expire by age. When you delete one, every piece of it goes, and a daily job finishes any deletion that was interrupted.
DELETE /api/deals/7f3a
Removed in order. Safe to retry. Cloudflare’s own recovery backups expire on its schedule (up to 30 days).
HTTPS only, storage encrypted at rest, and a workspace that runs nothing but our own code.
Our one usage log records counts and timings. The content of your deal is never written to it.
qa.usage status=answered calls=2 tokens=1284 latency_ms=2140Sanctions screening of the company, its people and its entities runs inside our service against a bundled copy of the public lists. The names never leave.
Illustrative company from our sample deal.
Where your data goes
Most security pages stop at “encrypted everywhere”. This is the full map for the workspace.
The deal you have open and your recent questions, held in page memory. Responses are marked not to be cached.
Until you close the pageCloudflare · inside our boundary
Your original files, the figures and text extracted from them, the analysis and memo, saved Q&A and your analyst notes.
Until you delete the dealDocument text, images of scanned pages for reading, and your questions with the figures needed to answer them.
Sent with a request not to store itOnly when you click Find online: we read the company’s website and send Brave the company name and people’s names. No figures, text or files.
Their own request logsNever sent to
Report a vulnerability
Email support@creditmarkit.com with “Security report” in the subject. Include steps to reproduce, and please do not access other people’s data or degrade the service while testing.
Contact: mailto:support@creditmarkit.com
Expires: 2027-10-08T00:00:00.000Z
Preferred-Languages: en
Canonical: https://creditmarkit.com/.well-known/security.txt
Policy: https://creditmarkit.com/security.html#disclosure