Anteriq Security & Trust Overview
Financial planning firms entrust Anteriq with some of the most sensitive data their clients share — income, assets, liabilities, goals, and family circumstances. We take that responsibility seriously. This page describes, in plain language, the security controls we have built into the Anteriq platform so that firms conducting due diligence can understand how we protect that data.
Relationship to other documents. This page is a summary for general audiences. The binding, contractual commitments — including a full Security Exhibit — are set out in the Data Processing Addendum (“DPA”). How we handle personal information on your behalf is described in the Anteriq Privacy Policy, which is presented for acceptance in the application. Because security practices evolve, the DPA and its Security Exhibit are the authoritative source of any contractually enforceable commitments; this overview will be updated to stay aligned with them.
Scope. Anteriq is a U.S.-only software service. We are not a HIPAA covered entity and do not collect protected health information.
1. Authentication & Access
We use Amazon Cognito — a managed, enterprise-grade identity service operated by Amazon Web Services — to handle authentication for every user on the platform.
Passkeys (hardware/biometric authentication). Both financial planners and their clients can sign in using a passkey — a cryptographic credential tied to a device (such as a phone’s Face ID, Touch ID, or a hardware security key). Passkeys are phishing-resistant by design: the private key never leaves your device and cannot be stolen by an attacker who tricks you into visiting a lookalike website.
Multi-factor authentication (MFA) via authenticator app. As an additional sign-in option for clients, the platform supports password plus a time-based one-time password (TOTP) generated by an authenticator app (such as Google Authenticator or Authy). This means a stolen password alone is not enough to access an account.
Planner and administrator accounts use passkeys only. Administrators and planners must authenticate exclusively via passkey — a stronger posture appropriate to the elevated access that account type carries.
Session controls. Sessions are issued as cryptographically signed tokens with a limited lifetime. Planner sessions are intentionally short — 15-minute access tokens with an 8-hour refresh window. Client sessions use 60-minute access tokens with a 60-day refresh window, reflecting that clients return to the portal occasionally rather than working in it daily. Clients may also be logged out of all other active sessions on demand.
First-access magic links. A new client’s first sign-in uses a time-limited, single-use link sent to their verified email address.
Backup recovery codes. Each user is issued a set of single-use recovery codes when they enroll. A recovery code allows a user who has lost access to their passkey or authenticator to sign in once and re-establish a factor. Codes are stored only as hashes, are consumed on use, and can be regenerated at any time — regenerating invalidates every previously issued code.
Adding a device. A user who wants to enroll a passkey on a second device does so through a short-lived, single-use enrollment flow initiated from a device they are already signed in on, rather than by weakening the sign-in requirements on the new device.
Recognized devices. For repeat sign-ins, the platform can recognize a device the user has previously used and apply adaptive risk signals, so routine access from a known device is smooth while unfamiliar access is challenged.
2. Tenant Isolation
Anteriq serves multiple financial planning firms from a shared platform. Every piece of data — every question, every client answer, every document — is tagged with a firm identifier at the time it is created, and that tag is validated on every read and write operation.
A user authenticated as a client of Firm A cannot access, see, or enumerate any data belonging to Firm B. A planner at Firm A cannot access any data belonging to Firm B. This isolation is enforced in the data layer, not merely at the user-interface level. It is not configurable — there is no setting that could accidentally open a firm’s data to another.
Access rights within a firm flow from a user’s verified identity. Planners can see client data for their firm; clients can see only their own data.
3. Encryption
In transit. All connections between your browser and Anteriq — and between Anteriq’s components — use TLS 1.2 or higher. A request arriving over unencrypted HTTP is redirected to HTTPS before any application data is exchanged, and the HSTS header instructs browsers not to attempt plaintext again for two years. At the storage layer the posture is stricter: every bucket holding Customer Data denies any request not made over TLS outright, rather than redirecting it.
At rest. All Customer Data is encrypted at rest. Beneath the application, AWS encrypts every store under keys Anteriq does not manage — object storage (Amazon S3) uses SSE-S3, which is AES-256 encryption with Amazon S3-managed keys, and the database (Amazon DynamoDB) uses its default AWS-owned key; neither of those keys is held in Anteriq’s own KMS key inventory or governed by a key policy Anteriq controls. Above that, Anteriq’s application code adds a second layer to sensitive data fields and to every document stored in the platform — documents uploaded by end clients, files uploaded by firms, files attached to planner notes, and signed documents — using a single dedicated application KMS CMK (customer master key) in AWS Key Management Service (KMS). That same AWS-layer encryption covers Anteriq’s other stored data, including operational and audit records held in the same systems. AWS KMS is a FIPS 140-2 validated key management service.
Field-level encryption for especially sensitive answers. Certain answer fields — those a planner designates as sensitive — receive a second layer of encryption at the application level, before they are written to the database. Each encryption operation is cryptographically bound to the specific record it belongs to, using AWS KMS. This means a ciphertext cannot be silently moved to a different record, and each access to the underlying key is individually attributable.
Encrypted document storage. Every document the platform stores — client uploads, firm library files, planner note attachments, and signed PDFs — is held in an encrypted envelope using AES-256-GCM with a unique data key per file. Each per-file key is itself generated and protected by AWS KMS. The result is that each document is protected by its own encryption key.
4. Application & Platform Security
Hosted on AWS. Anteriq runs entirely on Amazon Web Services infrastructure hosted in the United States (US region). We do not operate our own data centers.
HTTP security headers. The Anteriq web application is delivered through Amazon CloudFront (AWS’s content delivery network). We configure CloudFront to send a set of security response headers with every page:
- HTTP Strict Transport Security (HSTS) with a two-year max-age and
includeSubDomains— tells your browser to always use an encrypted connection for Anteriq, even if you type the address withouthttps://. - Content-Security-Policy (CSP) — restricts which sources the browser is allowed to load scripts, styles, and other resources from, reducing the risk of cross-site scripting attacks.
- X-Content-Type-Options: nosniff — prevents the browser from guessing the type of a file in ways that could enable certain attacks.
- Referrer-Policy — limits how much information about the originating page is sent when navigating away.
- X-Frame-Options: SAMEORIGIN — prevents the Anteriq portal from being embedded inside another website’s frame (a common attack technique called “clickjacking”).
Rate limiting. Anteriq’s backend applies rate limiting to sensitive and abuse-prone endpoints to protect against brute-force and automated-abuse attempts. Public endpoints use platform-wide counters and fail safely if the rate-limiting subsystem is unavailable.
CSV / spreadsheet injection protection. Data that planners export to CSV is sanitized to neutralize formula-injection payloads (a category of attack where a value entered into the portal could, without this protection, execute a macro when the export file is opened in a spreadsheet application). A deploy-time check enforces that user-controlled data passes through this sanitizer before being included in any export.
Payment card data. Anteriq does not store, process, or transmit credit card numbers. Card details are entered directly into payment fields hosted by Stripe that the Anteriq page cannot read.
There are two separate billing relationships, and Anteriq holds no card number in either. Anteriq bills each firm for its own Anteriq subscription through Anteriq’s Stripe account. Separately, a firm that bills its own clients through the platform does so through that firm’s own Stripe account. For a firm’s subscription, Anteriq retains only a masked card summary — brand and last four digits — and a card fingerprint supplied by Stripe, which is used to detect duplicate free-trial signups. The full card number is never available to Anteriq.
5. Monitoring & Audit Logging
Anteriq records an audit trail of security-relevant and operationally important events. These records capture who did what, to which resource, and when.
Support and administrative access. Anteriq platform administrators can, in limited circumstances and with a firm’s prior consent, access a firm’s environment to provide support. This access:
- requires the firm to have explicitly granted consent (consent is logged and can be revoked by the firm at any time);
- is performed under a short-lived session token (maximum 15-minute duration);
- is recorded in the audit log with the impersonating administrator’s identity and a flag indicating the impersonation context.
Planners at your firm can see that administrative access occurred, and an administrator at your firm can revoke consent at any time from the firm’s configuration settings, under Config → Platform support access.
Step-up re-authentication for irreversible actions. A small number of platform actions cannot be undone — deleting a firm, resetting a firm’s billing records, exporting a firm’s entire dataset, cancelling a subscription immediately, and releasing an administrative hold. For each of these, it is not enough for a platform administrator to hold a valid session: they must have re-authenticated with their passkey within the previous two minutes. A request carrying an older session is refused outright. This means an unattended or hijacked session cannot be used to perform a destructive action.
Infrastructure-level logging. AWS CloudTrail records infrastructure-level events, including each use of encryption keys via AWS KMS. This means key access — including to the keys protecting sensitive field-level encrypted answers and signed documents — is independently logged at the cloud infrastructure layer, outside of Anteriq’s own application code.
Log availability. Lambda execution logs and API Gateway access logs are retained in AWS CloudWatch for 365 days under an explicit retention policy applied to the Anteriq application’s production log groups. AWS CloudTrail logs are retained for approximately 400 days in a dedicated S3 bucket.
Backup and recovery. Your data is protected by Point-in-Time Recovery with a 35-day continuous recovery window, allowing a restore to any moment in that period. Separately, scheduled backups of both the database and stored files are written to a backup vault under AWS Backup Vault Lock: daily copies kept 35 days, and a monthly copy kept 12 months. For a seven-day cooling-off period after the vault is created, the lock operates in governance mode — it is in force, but Anteriq can still change or remove the lock configuration, which is the only window in which a wrong retention value can be caught. Once that period ends the lock configuration is permanent: a backup copy cannot be altered, and cannot be deleted before its retention period expires — including by Anteriq. Those copies remain recoverable even if the production environment or its administrative credentials were compromised. Stored files additionally retain prior versions for 90 days, so an accidental overwrite or deletion can be reversed immediately. A restore is exercised at least once a year and the elapsed time recorded.
Threat detection and posture monitoring. Anteriq operates a continuous-monitoring program: AWS GuardDuty provides automated threat detection (analyzing CloudTrail, DNS, and network-level signals for indicators of compromise, to the extent those signals exist in Anteriq’s environment — the Anteriq application runs on AWS-managed compute rather than in a virtual private cloud (VPC) network of its own, so the VPC and DNS log sources GuardDuty can analyze are not present here); AWS Security Hub aggregates findings and continuously evaluates Anteriq’s AWS configuration against security best practices; and AWS Config records the configuration state of resources to detect configuration drift.
6. Artificial Intelligence
Anteriq uses AI to assist planners with tasks such as extracting structured data from uploaded documents and summarizing planner notes. We expect to add further AI-assisted features over time. The following applies to all of them.
Where inference runs. All AI processing runs on Amazon Bedrock inside Anteriq’s own AWS account. Your data is never sent to a model vendor’s own API or to a consumer AI service.
Your data is not training data. According to AWS, inputs to and outputs from Amazon Bedrock are not used to train Amazon’s or any third-party foundation models, and are not shared with model providers — the providers have no access to the accounts that run inference, and therefore no access to prompts or completions. Anteriq likewise does not use customer or end-client data to train any model of its own.
Where processing happens. Anteriq uses a United States inference profile, which keeps processing within AWS’s US regions. Requests may be routed among those regions for capacity, and where AWS’s automated abuse detection stores inputs and outputs, that storage also remains within US regions.
AI runs only where three separate controls all permit it. A platform-level control governs AI across the whole service and fails closed — if it cannot be read for any reason, AI does not run for anyone. Beneath it, each firm is separately entitled to the specific modules whose features use AI; a firm without that entitlement has no AI processing of any kind. Finally, each firm holds its own AI switch: a firm’s owner can turn off all AI processing for that firm from the firm’s own settings, without contacting us — and Anteriq staff cannot turn it back on, including while providing support access. Separately, a firm may cap what it spends on AI; that is a cost control, not a privacy control.
The corresponding contractual commitment is in the DPA.
7. Our Subprocessors
Anteriq uses a small number of reputable third-party services to operate the platform. These services are listed — along with the data each one processes — in the Subprocessor List. That list does not state where those vendors process data; each operates its own infrastructure under its own regional practices. The list also identifies customer-directed integrations — third-party services your firm may choose to connect, which your firm engages under its own account.
The list is incorporated into the DPA. We will notify customers of material changes to our subprocessor list in accordance with the notice mechanism described in the DPA.
8. Data Ownership, Retention & Deletion
Your firm owns its data. The information your clients provide through the Anteriq portal belongs to your firm (and, ultimately, to your clients). Anteriq uses that data solely to deliver the Service to you and is prohibited from using it for any other commercial purpose.
Export. Your firm can export an individual client’s data — answers, documents, and activity — directly from the platform at any time. A complete export of your firm’s entire dataset is available on request; because it egresses the whole firm’s records, it is performed by Anteriq under the step-up re-authentication control described above.
Deletion. When your firm’s subscription ends, or upon your firm’s request, Anteriq will delete your firm’s data in accordance with the commitments in the DPA. For the full detail on retention periods and deletion procedures, see the Data Retention & Deletion Policy.
9. Responsible Disclosure / Security Contact
If you believe you have discovered a security vulnerability in the Anteriq platform, please report it to us privately so we can investigate and address the issue before it is publicly disclosed. We do not pursue legal action against researchers who report vulnerabilities in good faith.
Security contact: security@anteriq.com
Please include a description of the vulnerability, steps to reproduce, and (if known) the potential impact. We will acknowledge your report and keep you informed as we investigate.
10. Security Governance
Controls are only as good as the practices that keep them current. Anteriq maintains a Written Information Security Program aligned to the FTC Safeguards Rule (16 CFR Part 314), with a named Qualified Individual accountable for it. The program, the risk assessment behind it, our policy documents, and who has access to what are reviewed together at least annually, and everyone with access to customer data acknowledges a written personnel security policy covering acceptable use, data handling, credential hygiene, and incident reporting. Access is granted on a need-to-know basis and revoked promptly on role change or departure.
Disaster recovery is tested, not assumed. Both of our database recovery paths — point-in-time recovery and restore from an immutable backup vault — have been exercised in drills, each verified by comparing the full restored item count against the source. Backups are held in a vault with a compliance-mode lock, so a retained recovery point cannot be deleted early by anyone, including us.
We record the date and outcome of each of these activities.
11. A Note on Compliance Certifications
We want to be straightforward: Anteriq has not yet completed a SOC 2 or ISO 27001 certification audit, and we do not claim HIPAA compliance or any PCI certification of our own — as described above, card data is entered directly into Stripe-hosted fields and Anteriq never receives a card number. We have not conducted third-party penetration testing on a formal cadence. We do operate automated, continuous threat detection and security posture monitoring through AWS GuardDuty and AWS Security Hub, but we do not operate a 24/7 security operations center.
The controls described on this page reflect what we have actually built and operate. We believe they are appropriate for a platform handling sensitive financial-planning data, and the DPA’s Security Exhibit sets out the contractual commitments attached to them. We continue to evaluate formal certification as our customer base grows, and will update this page if that changes.
12. Practices Evolve
Security is not a one-time project. We update our controls as threats change, as our platform grows, and as we incorporate feedback from customers and the security community. The authoritative, contractually binding description of our security commitments at any point in time is the Security Exhibit to the Data Processing Addendum. This overview is updated to stay aligned with that exhibit, but in the event of any conflict, the DPA controls.