First month free — no card needed. Use code at checkout. Limited to the first 25 companies.
First month free — code . Only 25 spots.
See plans →That isn't a policy we promise to follow. It's how the product is built: Anchor BI reads and parses your exports in your own browser, and there is no upload. We'd rather show you the architecture than hand you a badge.
The short version. Your trial balance, GL export, aging file or T&E card statement is opened and parsed on your machine. What gets saved to our database is the result, the monthly figures and account rollups the dashboard draws, stored in a single row that only your company's signed-in team can read. The AI commentary layer receives those computed figures, never your files.
When you drop a file into Anchor BI, the browser reads the bytes locally and does the parsing there, detecting the columns, reading the dates, mapping the chart of accounts. The file is never transmitted to us. We operate no file storage: there is no bucket, no attachment table, and no upload endpoint anywhere in the application.
The practical consequence is that the highest-risk artifact, your raw ledger, with every transaction, customer and vendor name in it, stays on your device. If our database were compromised tomorrow, your source files would not be in it, because they were never there.
Once parsing is done, the dashboard needs something to render next month. What we keep is the derived dataset:
Full line-item detail is deliberately not retained. It isn't needed to produce the statements, and keeping it would mean holding the very thing worth stealing.
Every stored row is keyed to your company, and row-level security is switched on for each table that holds customer data. The policies permit a signed-in user to read, write and delete only rows belonging to a company they are a member of, membership itself is a database table, checked inside PostgreSQL on every query, underneath the application.
A bug in our interface cannot expose another customer's data, because the request never reaches their rows in the first place. The credentials the browser holds are the public, anonymous key, the privileged service key exists only inside server-side functions and is never shipped to the browser.
Where a table holds something a browser should never see under any circumstances, the credentials for a connected accounting system, or the billing ledger, row-level security is enabled with no browser-facing write policies, or none at all. There is no query any browser key can construct that returns those rows.
Your subscription includes five logins, so your controller and your CFO are not sharing a password. Teammates are invited by email from your admin portal and join under their own credentials, with a role, owner, admin or member, that decides who can change settings, manage billing, or invite others. The seat count is enforced by the database function that processes invitations, not by the interface.
Any login can add two-factor authentication: a 6-digit code from an authenticator app on top of the password. The part worth an auditor's attention is where it is enforced. Once a login has two-factor switched on, the same row-level checks described in §3 refuse that login's data to any session that hasn't presented a code, including requests made directly against our API, skipping our app entirely. A stolen password alone reads nothing.
Anchor BI uses Claude, from Anthropic, to write the plain-English commentary and to help categorize unfamiliar account names. This is the part you should want specifics on, so here they are.
The request is made by a server-side function that requires a valid Anchor session, so our Anthropic API key is never exposed to the browser. Anthropic does not use data submitted through its commercial API to train its models without express permission, and we have given no such permission. Anthropic automatically deletes API inputs and outputs within 30 days, subject to limited exceptions in their published retention policy. We do not hold a zero-data-retention agreement with Anthropic; if that matters to your diligence, say so and we will pursue one.
The model is also constrained by design: it is instructed to explain only the figures it was given and never to perform new arithmetic. Every number on your dashboard is computed by our code from your own file, the AI describes what moved, it does not produce the numbers.
us-west-2. Data is encrypted in transit and at rest.@anchorbi.com and is cryptographically signed by our domain. An "Anchor" email from any other address is not from us.If you connect QuickBooks Online, the connection is authorized by you through Intuit's own consent screen. We receive report-level data via Intuit's API and convert it into exactly the same shape a dropped file produces. The access and refresh tokens live in an encrypted secrets vault, separate from the application tables, the application table holds only opaque references to them, and neither is readable by any browser key. You can disconnect at any time from your settings, which revokes the connection at Intuit and destroys the stored secrets.
Two different things, described honestly, because they are often conflated:
In both cases, the contact record created when you signed up or used the contact form, your name, email and company, is retained as part of our business records. We do not take automatic database backups on our current hosting plan; apart from a short-lived engineering snapshot made during a schema migration and destroyed once the migration has proven itself, a deleted row is not held in any backup we could restore it from. If you want your contact record erased as well, email us and we will do it.
The third parties that process customer data on our behalf:
| Provider | Purpose | Data involved |
|---|---|---|
| Supabase | Database, authentication, server-side functions | Account details, derived financial dataset |
| Amazon Web Services | Underlying infrastructure for Supabase | As above, at rest |
| Cloudflare | Site hosting and delivery | Request metadata; no financial data |
| Anthropic | AI commentary and account categorization | Computed figures and account names, as described in §5 |
| Stripe | Subscription payments, invoices and the billing portal | Your email, card and billing address, held by Stripe and never by us; no financial dataset |
| Resend | Sending the product's own emails (signup confirmation, password reset) | Your email address and the email content; no financial data |
| Intuit | QuickBooks Online connection, if you enable it | Report data you authorize |
If you believe you have found a security issue, email [email protected] with the details. We will acknowledge it, and we will not pursue anyone who reports a genuine issue to us in good faith and gives us a reasonable chance to fix it before disclosing it.
For how we handle personal information generally, see our Privacy Policy. For the terms governing use of the service, see our Terms of Service.
Last updated August 18, 2026 · Anchor Partners LLC, Charlotte, North Carolina
Ask them. We would rather spend an hour on your security review than have you wonder.
Talk to us