Security
Steward holds the things a family would struggle to replace: where the accounts are, who the attorney is, what the trust says, and letters written for one person to read one day. This page says plainly how that is protected, and what we have not done yet.
Who can read what
Every family's record is isolated in the database
Access is enforced by row-level security in Postgres, not by application code deciding what to show. A query that asks for another family’s records returns nothing, whoever is asking and however the question is sent.
A seat can be narrowed to part of the record
An accountant given two trusts sees two trusts. The third is not hidden from their screen; it is never returned to them. The same boundary applies to the search, the exports and the assistant.
Legacy letters are private from administrators too
A letter or recording written for a named person can be read by its author and the people it was written for. A workspace administrator can see that it exists and who it is addressed to, and cannot read a word of it. That rule is enforced in the database, not only in the screens.
Every change and every sensitive view is recorded
The audit log shows who did what and when, and the family can read it themselves. It is not an internal log we keep and they take on trust.
Sensitive information
Social Security numbers are not stored as text
Steward keeps the last four digits for recognition. The full number goes to an encrypted vault, separate from the record. Revealing it requires sensitive-information access, and every reveal is written to the audit log in the reader’s name.
Bank connections are read-only, and the keys are vaulted
Steward can read balances and transactions. It cannot move money, because it never asks for the permission that would allow it. The access tokens live in an encrypted vault rather than in a column.
Deleting means deleting
A deleted record goes to a recycle bin the family controls, with a retention window they set. When the window passes it is removed, and the audit log keeps the fact that it happened.
Your questions are yours, answers are not kept
When someone asks the assistant a question, the audit log records that they asked, and when, which administrators can read. The question itself is kept for that person alone and is not shown to anyone else in the family, including administrators. The assistant is sent only the parts of the record the person asking can already open, and never the contents of a legacy letter, a full account number or a Social Security number.
The assistant uses an AI provider outside Steward
To answer a question, the part of the record that person can open is sent to our AI provider. It is not used to train a model. It may be held by the provider for a short period for abuse monitoring.
The data is theirs to take
Any member can download everything they can see as a spreadsheet, at any time, without asking us. A record only Steward can read would not be keeping the promise this product makes.
What we have not done
Steward is not yet certified under SOC 2 or any comparable scheme, and we would rather say so than imply otherwise. An independent penetration test and a SOC 2 Type I report are planned before the first family pays for this. Until then, the protections above are things you can ask us to demonstrate rather than things we have had audited.
The assistant can be wrong. It answers from what is written down, so it inherits anything the record gets wrong, and nothing it writes is reviewed by a person before you read it. We have also not yet confirmed in writing how long our AI provider holds a question before discarding it.
Steward is also still in active testing. We would not recommend putting irreplaceable original documents in it as the only copy today.
Found a problem, or want something above demonstrated? Write to security@lsmfh.com.