Our AI features process your data in an external LLM service that keeps nothing, and store everything that persists inside AlternativeSoft on Microsoft Azure: Encrypted at rest and in transit, isolated per client, audited every year.
AlternativeSoft's AI features run on a simple security model: AI processing happens in an external Large Language Model service under a strict zero-retention policy, and every piece of persistent storage stays inside the AlternativeSoft platform, hosted on Microsoft Azure. The LLM service, currently defaulting to Anthropic's Claude, never stores or trains on client data. Everything at rest is encrypted with AES-256, everything in transit with TLS 1.2 or higher, access is governed by role-based controls and multi-factor authentication, and AlternativeSoft is SOC 2 certified with annual independent third-party audits. This page summarises our AI Features Security Posture document; tailored documentation and certification details are available from our support team.
The four stages of the AI data lifecycle, and the security measures at each one.
| Stage | What happens | Security measures | |
|---|---|---|---|
| 1. Ingestion | Documents and data enter the AlternativeSoft platform directly. Nothing is shared externally at this stage. | Stored on Microsoft Azure with AES-256 at rest and TLS 1.2+ in transit; data validation checks; role-based access controls; each client's data isolated in its own account | |
| 2. AI processing | Relevant data is processed by the external LLM service in real time to generate analytics and insights, then discarded by the service. | Strict zero-retention policy: Nothing is stored or retained by the LLM service after processing; communications encrypted end to end; anonymised or aggregated data used where possible; processing audited internally, with logs kept in AlternativeSoft without sensitive client data | |
| 3. Storage of results | Analytics results are stored back in AlternativeSoft on a per-asset basis, so they can be retrieved without repeated external processing. | Same Azure encryption and access controls as ingested data; results never shared across clients or with third parties without explicit authorisation; retention configurable, with automatic deletion after a period you set; regular vulnerability scans and penetration testing | |
| 4. Display and access | Processed insights are displayed to authorised users inside the AlternativeSoft platform. | Multi-factor authentication, session timeouts and audit trails; data is never exported or displayed outside secure channels without explicit client consent |
The commitments below come directly from our AI Features Security Posture document.
The LLM service does not store or train on your data, so it cannot be used for any other purpose.
Client data is never shared with third parties beyond the controlled, zero-retention processing by the LLM service.
AES-256 at rest on Microsoft Azure and TLS 1.2 or higher in transit, including every exchange with the LLM service.
Role-based access controls limit data to authorised personnel; users sign in with multi-factor authentication, and sessions time out.
Access logs and security reports are available on request, and the platform undergoes independent third-party audits annually.
In the unlikely event of a security incident, a structured response plan applies, with prompt client notification as required by law.
AI processing uses an external Large Language Model service, currently defaulting to Anthropic's Claude. The service can vary with performance requirements and feature needs, and clients with specific requirements can lock processing to a particular service or supply their own LLM service. Whichever model runs, the same rule applies: Processing is real-time only, and nothing persists in the AI service.
Persistent storage has one home: The AlternativeSoft platform, hosted on Microsoft Azure. Analytics results are kept per asset so they load instantly without being re-processed externally, your retention preferences decide how long they are kept, and nothing is disclosed to third parties without your explicit authorisation. The one deliberate exception is a choice the client makes: When a fund manager makes a fund publicly available on the platform, its pre-generated analytical reports can be made accessible with it.
If your compliance team needs more than this page, we provide tailored documentation and certification details, access logs and security reports on request: Ask us or email support@alternativesoft.com.
Bring your compliance team's checklist. We answer it against the platform and provide the documentation your review needs.