Privacy Policy

Steightment ("we", "us") provides AI-assisted bookkeeping and fractional-CFO software, with a focus on organizations that manage federal and state grant funding. This policy explains what data we handle, why, and the controls you have. Contact: privacy@steightment.com.

Account data — your name, email address, and authentication records, managed through our sign-in provider (Clerk).

Financial data you or your integrations provide — transactions, accounts, budgets, awards, invoices, customers, and documents you upload. If you connect a bank through Plaid, we receive read-only transaction and balance data; we never see or store your bank credentials. If you connect QuickBooks Online, we access accounting data under the permissions you grant on Intuit’s consent screen.

Usage and diagnostic data — standard server logs and error reports needed to keep the service reliable.

To provide the service: maintaining your books, categorizing transactions (including via AI models), generating reports, invoices, and compliance documents, and sending the notifications you configure.

We do not sell your data. We do not use your financial data to advertise to you or anyone else.

AI processing: transaction descriptions may be sent to our AI provider to suggest categories and flag anomalies. These requests are scoped to the minimum data needed and are not used by us to train public models.

We run on established infrastructure providers, each bound by their own security and privacy commitments:

• Vercel — application hosting
• Neon — encrypted Postgres database
• Cloudflare R2 — encrypted document storage
• Clerk — authentication
• Plaid — bank connections (read-only)
• Intuit — QuickBooks Online integration, when you connect it
• OpenRouter / Anthropic — AI categorization requests
• Resend — transactional email delivery

We share data with these providers only as needed to run the service, and with no one else except when the law requires it.

Data is encrypted in transit (TLS) and at rest (AES-256). Integration tokens are additionally encrypted at the application layer before storage. Every workspace is isolated — access is enforced on the server for every request, backed by database-level row security. Every change to your books is recorded in an audit trail. Details in plain English: see our Security page.

Your data stays as long as your workspace exists. Workspace owners can export everything (portable JSON plus documents) at any time, and can delete the workspace — access closes immediately, the owner can cancel within 30 days, and after that the books, documents, and stored files are permanently purged (unless a legal hold requires us to preserve them). Note that grant recipients typically have their own federal record-retention obligations (2 CFR 200.334); exporting before deleting is built into the product’s offboarding flow.

You can access, correct, export, or delete your data through the product, or by writing to privacy@steightment.com. If you are in a jurisdiction with specific privacy rights (e.g., GDPR, CCPA), we honor access, portability, correction, and deletion requests consistent with those laws.

If this policy changes materially, we will notify workspace owners by email before the change takes effect. The date below always reflects the current version.