Security
Sealed evidence. Explicit authority. Read-only review. Footing puts controls into the path of the work, so protecting the record depends less on someone remembering every rule.
Policy belongs in the process
A careful person can still send the wrong attachment or approve a change while distracted. The client’s agent platform sets who can connect, which tools they can use and when approval is required. Footing validates what reaches the service.
Protect the record
Every figure should carry a path back to its evidence. Security protects that path as well as access to the data.
Source documents are converted and checked before becoming sealed Standard Documents. Only sealed documents enter the financial workspace. AES-256-GCM authenticated encryption protects their contents; altered sealed bytes fail verification and are refused.
A correction is a new sealed document. The original stays as it was, preserving the source history instead of silently overwriting it.
Every change is a tool call from the client’s agent. Access uses OAuth through WorkOS, with a passkey, email code or the client’s SSO. Tokens are checked for signature, issuer, audience and expiry.
A deliberate boundary
Footing works on what your agent submits. It holds no credentials or connections into your bank, ledger, email or file systems.
Your agent chooses what to send. Footing does not reach into client systems to retrieve it.
Results return to the agent. Your people and policies decide what gets posted to your systems.
File transfers use FinStat’s own signed links. The client’s agent controls the exchange under the client’s policy.
Human review
The workspace viewer is for inspection. It never changes workspace data.
Sign-in is required, and access is limited to the workspace’s owner. A viewer link carries no credential. Read-only access is enforced at the database boundary, not just by hiding editing buttons.
People can examine the documents, the accounting and the questions that need judgment. Changes still go through the client’s agent and the service’s checks.
Assurance and enforcement
A certification cannot choose the right attachment or stop a distracted approval. Those checks belong in the operation itself.
Independent provider audits complement Footing’s controls. AI providers process client data under business terms that exclude its use for training. The client’s approved agent environment remains part of the security boundary.
Footing’s approach combines client policy, service validation and evidence people can review. None is a substitute for the others.
The distinctions that matter
The seal uses authenticated encryption to protect the document’s contents and make alteration detectable. It does not prove the original source is truthful. Reconciliation and professional review still address what the evidence means.
Yes. Client policy and agent approval work alongside engine validation, sealed documents and human review. Footing reduces dependence on routine manual handling without treating an agent as infallible.
The client sets access and approval policy in its agent platform. The agent submits authorized actions; the service validates them. The accountant resolves judgment calls and signs off on the work. The viewer cannot change the record.
Contact support@finstat.ai to discuss your integration, access policy and security requirements.
The reality layer for finance
Let’s discuss your workflow