Privacy & Legal

1. Who we are and what this policy covers

FinStream is a finance operating platform for procurement, accounts payable, treasury, accounting, tax and financial planning. It is operated by 111255 PTE. LTD., 160 Robinson Road, #14-04 Singapore Business Federation Center, Singapore 068914 ("FinStream", "we", "us").

This policy covers the FinStream web application at finstream.app, the supplier portal, our transactional emails, and the AI-assistant connector that lets a customer connect an assistant such as Claude to their own FinStream account. It does not cover a third-party service you separately connect to FinStream — that service is governed by its own policy.

2. Our role: when we are a controller and when we are a processor

We act as a processor (a service provider) for the finance records a customer organisation enters into FinStream — its vendors, purchase requests, purchase orders, invoices, payment runs and accounting entries. The customer organisation decides what that data is and why it is there; we process it under our agreement with them.

We act as a controller for the data we need in order to run FinStream itself: account identity, organisation membership and role, sign-in and security events, support correspondence, connector authorisations, and product telemetry. Where the two overlap, the stricter treatment applies.

3. Information we collect

We collect only what the platform needs to function. We do not buy personal data from data brokers, we do not run advertising, and we do not sell or share personal data for cross-context behavioural advertising.

• Account identity — Your email address, your display name, the organisations and companies you belong to, your role (admin, approver, editor or viewer) and the approval capabilities granted to you.
• Authentication data — Password hashes and session tokens held by our authentication provider, and sign-in, sign-out and password-reset events. We never see or store your password in readable form.
• Customer finance records — The records your organisation enters or imports: vendors and their contacts, cost centres and budgets, purchase requests and orders, invoices and credit notes, tax determinations, journal entries and accounting periods.
• Uploaded documents — Invoice PDFs and images, purchase-order attachments, bank statements and supporting evidence you or your suppliers upload, together with the text extracted from them.
• Supplier data — Where a supplier uses the supplier portal, the profile and banking details that supplier maintains about itself, and the approval decisions a buyer takes on them.
• Connector authorisations — For each AI assistant you connect: which assistant it is, the identity scopes it was granted, and when the grant was made. You can see and revoke every grant in Settings, Integrations, Agents.
• Connector call telemetry — One row per assistant tool call: the tool name, the outcome, your user id, the resolved organisation and company, and a SHA-256 hash of the call arguments. We store the hash, never the arguments themselves.
• Service logs — IP address, user agent, timestamps, request paths and error traces produced by our hosting and database providers in the ordinary course of serving requests.
• Communications — Emails you send to our support or security mailboxes, and the delivery status of the transactional emails we send you.

Vendor and supplier records may include a business tax registration number and company registration number, because invoices and tax determinations depend on them.

4. How we use information

• To provide the platform: authenticate you, show you the records your role permits, route approvals, match invoices to purchase orders, build payment runs and post accounting entries.
• To extract data from documents you upload, using third-party artificial-intelligence services engaged on our behalf, so that an invoice does not have to be typed twice.
• To suggest general-ledger coding and detect tax treatments, which a human then accepts or changes. A suggestion is never an approval.
• To send transactional email: invitations, approval requests, remittance advices, supplier notifications and security notices. We do not send marketing email to platform users.
• To keep the platform secure and available: rate limiting, abuse detection, audit trails, error monitoring and backups.
• To support you when you ask us to, and to investigate a reported problem.
• To meet our legal, tax and accounting obligations, and to enforce our terms.

5. The AI-assistant connector: what it can and cannot see

A FinStream administrator can allow AI-assistant access for their organisation, and each user can then connect their own assistant. The connection is made with OAuth 2.1: you sign in to FinStream yourself and approve the connection on a FinStream consent screen. No administrator can connect an assistant on your behalf, and no assistant is connected by default — organisation access is off until an administrator turns it on.

• A connected assistant sees exactly what your own FinStream account sees, and nothing more. Every tool call re-runs the same server-side permission checks the web application uses, for your user, in your organisation.
• A connected assistant can read finance records and create or edit drafts. It cannot approve anything, release a payment, move money, post or close an accounting period, or delete a record. Those actions are human actions inside FinStream and are structurally unavailable on the connector surface.
• FinStream never reads your assistant's conversation history, its memory, its files, or anything else on the assistant's side. The connector is inbound only: the assistant calls FinStream; FinStream never reaches back into the assistant for your data.
• Turning organisation access off blocks every further tool call immediately. Existing grants stay in place, inert, until you revoke them.

When you use a third-party assistant with FinStream, your conversation with that assistant is governed by that assistant vendor's own privacy policy, not by this one. What FinStream returns to the assistant becomes part of that conversation.

6. How we share information

In the course of providing the service we engage third-party service providers that process information on our behalf and on our documented instructions, including without limitation providers of database, application hosting, content delivery, authentication, transactional email, document-extraction and other artificial-intelligence processing services, and, where your organisation elects to connect them, accounting and payment-gateway providers. Such providers are permitted to process information only to the extent necessary to deliver their service to us, and each is bound by contractual obligations of confidentiality and data protection no less protective than those set out in this policy. The identity of the providers we use may change from time to time as our operational needs require.

We do not sell personal data, and we share nothing with advertisers or data brokers.

7. Where information is stored and transferred

FinStream is operated from Singapore. Customer data is held in our database provider's data centre in Mumbai, India.

Where a transfer leaves a jurisdiction with transfer restrictions, we rely on the mechanism available to that transfer — most often the European Commission's standard contractual clauses or the equivalent UK addendum, incorporated in our agreements with the providers concerned.

8. How long we keep information

• Customer finance records and uploaded documents — For as long as your organisation's account is active, and afterwards for as long as your organisation instructs us or the law requires. Finance records commonly carry a statutory retention period in the customer's own jurisdiction, and we do not delete them ahead of the customer's instruction.
• Business audit trail — Retained for the life of the account. Who approved, submitted, issued, released or voided a document is what makes the record trustworthy, so it is append-only and is not pruned.
• Connector call telemetry — 365 days, then purged automatically by a scheduled database job. There is no manual override and the application holds no delete permission on the table.
• Connector authorisations — Until you revoke them, or until your account is deleted.
• Account identity and membership — For as long as you are a member of an organisation. Removing a member ends their access immediately; their name remains visible in the audit trail of actions they took.
• Service logs — Retained for a short operational period by our hosting and database providers, in line with their published defaults.
• Support and security correspondence — Retained while it is needed to resolve your issue and to keep a record of the resolution.

Backups are held on a rolling schedule by our database provider and expire automatically; a deletion is reflected in backups as they roll off.

9. Your choices: access, correction, export, deletion and revocation

• You can see and change your own profile in the application, and an administrator of your organisation can change your role and capabilities.
• You can revoke a connected assistant at any time in Settings, Integrations, Agents. Revoking ends that assistant's access at once.
• You can ask us for a copy of your organisation's data, or for its deletion, by writing to [email protected] from the address on your account. We verify the request with an administrator of the organisation, because the data belongs to the organisation rather than to any one member, and we act on it within 30 days.
• Depending on where you live you may also have the right to correct or delete personal data, to restrict or object to processing, to portability, to withdraw a consent you gave, and to complain to your data-protection authority. We do not charge for exercising these rights and we do not treat you differently for it.

Some data cannot be deleted on request without destroying the integrity of a finance record — an approval you gave on an invoice, for instance, is part of that invoice's audit trail. Where we must refuse or limit a deletion for that reason, we tell you why.

10. Security

• All traffic is served over HTTPS; data is encrypted in transit and at rest by our database and storage provider.
• Tenant isolation is enforced in the database itself by row-level security, in addition to the server-side permission checks every request passes.
• Access tokens are asymmetrically signed (ES256) and verified against the published key set on every request, including every assistant tool call.
• Assistant tool calls pass a per-user rate limit and are recorded in the telemetry described above.
• Third-party credentials, such as an accounting connection's tokens, are encrypted before storage.
• Internal access to production data is limited to the people who need it to operate the service.

No system is perfectly secure. If you believe you have found a vulnerability, please report it to [email protected]; our disclosure practice and the response you can expect are set out at https://www.finstream.app/security.

11. Changes to this policy

We update this policy when the platform or our providers change. The effective date at the top of the page always reflects the current version. If a change materially reduces your rights or expands how we use personal data, we will notify organisation administrators by email before it takes effect.

12. How to contact us

• Product, account and privacy requests — [email protected]
• Security vulnerabilities — [email protected] — see https://www.finstream.app/security
• Postal address — 111255 PTE. LTD., 160 Robinson Road, #14-04 Singapore Business Federation Center, Singapore 068914

1. These terms and who they bind

These terms are an agreement between 111255 PTE. LTD., 160 Robinson Road, #14-04 Singapore Business Federation Center, Singapore 068914 ("FinStream", "we") and the organisation that subscribes to FinStream ("Customer", "you"). By creating an organisation, accepting an invitation, or using FinStream, you accept these terms on behalf of your organisation and confirm you are authorised to do so.

Where FinStream and a Customer have signed a separate written agreement or order form, that document governs and these terms fill the gaps it leaves.

2. The service

FinStream is a hosted finance operating platform. It covers procurement (purchase requests and purchase orders), accounts payable (invoice capture, two-way matching to purchase orders, exception handling), tax determination, treasury (payment runs), accounting (journals, periods and close) and financial planning, together with a supplier portal and an optional AI-assistant connector.

FinStream is a system of record and a workflow tool. It is not a bank, a payment institution, a money-services business, an accounting firm, a tax adviser or an auditor. It does not hold your funds and it does not give professional advice. Payments are executed by the payment provider you connect, under your own agreement with that provider, and only after a person with treasury authority in your organisation has released them.

3. Accounts, roles and responsibility for your users

• You are responsible for your users' actions in FinStream, for keeping credentials confidential, and for removing members who leave. Approval authority you grant inside the platform is your decision, not ours.
• You will tell us promptly if you believe an account has been compromised.
• You must be legally capable of entering into a contract, and you must not use FinStream if we are barred from providing it to you under applicable sanctions or export law.

4. Acceptable use

You will not, and will not permit anyone to:

• Use FinStream to break the law, to launder money, to evade sanctions, to commit or conceal fraud, or to process a transaction you know to be improper.
• Upload malicious code, or content you have no right to upload.
• Attempt to access another organisation's data, to bypass a permission or approval control, or to probe, scan or load-test the service without our written permission. Reporting a vulnerability responsibly is welcome and is covered by our security page.
• Reverse engineer, resell, sublicense, frame or white-label the service, or use it to build a competing product.
• Interfere with the availability of the service for other customers, including by circumventing rate limits.
• Present FinStream output as professional accounting, tax or legal advice.

We may suspend access without notice where we reasonably believe continued use threatens the security, integrity or lawful operation of the service, and we will tell you why as soon as we can.

5. Your data

• Your data stays yours. You own the finance records, documents and other content you put into FinStream, and you keep every intellectual-property right in them.
• You grant us the limited licence we need to host, process, transmit, back up, display and — where you use them — run the platform's extraction, matching, coding and reporting features on that content, for the purpose of providing the service to you.
• You are responsible for having the right to put the content into FinStream, including any personal data of your own employees, suppliers and their staff.
• We handle personal data as described in our privacy policy at https://www.finstream.app/privacy, which forms part of these terms.
• You can export your data from the platform at any time, and you can ask us for an export or a deletion as described in the privacy policy.

6. AI assistants and connected agents

FinStream can be connected to an AI assistant, such as Claude, through its assistant connector. Access is off for an organisation until an administrator turns it on, and each user then authorises their own assistant by signing in to FinStream and approving the connection.

A connected assistant acts strictly under the permissions of the user who connected it: every call is re-checked server-side against that user's role, organisation and capabilities. An assistant may read records and create or edit drafts. It may not approve a purchase request, purchase order or invoice, release or execute a payment, post or close an accounting period, or delete a record. Every approval, payment release and accounting post or close remains a human action taken inside FinStream by a person who holds that authority — those actions do not exist on the connector surface at all.

An assistant is a drafting and reading aid, not a decision-maker. Output can be wrong, and you remain responsible for reviewing anything an assistant drafts before a person approves it. Your use of the assistant itself, and the conversation you have with it, are governed by the assistant vendor's own terms and privacy policy, not by ours.

Whether an assistant asks you to confirm each action is controlled by the assistant, not by FinStream. We describe every tool honestly so the assistant can make that judgement, and our documentation explains where you can change the setting.

7. Third-party integrations

FinStream can connect to services you already use — an accounting system, a payment gateway, your bank's statement exports, an AI assistant. You choose whether to connect them, and each connection is governed by your own agreement with that provider. We are not responsible for a third-party service's availability, accuracy, security or charges, and disconnecting one may reduce FinStream functionality.

8. Fees and payment

Fees, the billing period and the currency are those in your order form or subscription confirmation. Unless that document says otherwise: fees are payable in advance, are exclusive of taxes and withholdings, and are non-refundable once the period has begun. Subscriptions renew for successive periods unless either party gives notice before the period ends. We will give at least 30 days' notice of a price change taking effect at your next renewal.

During beta, FinStream may be provided at no charge or at a discount. Billing questions go to [email protected].

9. Our intellectual property

FinStream, its software, design, documentation and trademarks are and remain ours (or our licensors'). These terms grant you a non-exclusive, non-transferable right to use the service during your subscription, and nothing more. Feedback you send us is welcome, and we may use it without obligation to you; we will not identify you as its source without your permission.

10. Confidentiality

Each party will protect the other's non-public information with at least the care it uses for its own, will use it only to perform this agreement, and will disclose it only to people who need it and are bound to keep it confidential. This does not cover information that is public through no fault of the recipient, was already known to it, or is independently developed; and it does not prevent a disclosure required by law, where the recipient gives the other party notice if it lawfully can.

11. Warranties and disclaimer

We warrant that we will provide the service with reasonable skill and care and in line with our published security practices. Otherwise, and to the fullest extent the law allows, the service is provided "as is" and we disclaim all other warranties, express or implied, including merchantability, fitness for a particular purpose, non-infringement, and any warranty that the service will be uninterrupted, error-free, or that its extraction, matching, coding, tax or reporting output will be accurate or complete. Beta features carry no warranty and no availability commitment.

FinStream does not verify the truth of the finance records you enter and is not a substitute for your own internal controls, reconciliation, or professional advice.

12. Your responsibility and our exclusion of liability

You use FinStream at your own risk and you take full responsibility for that use: for the records you enter, for the decisions your users take on them, for every approval, payment release and accounting entry made in your organisation, and for meeting your own legal, tax and accounting obligations. FinStream is a tool that records and routes your organisation's work; it does not take those decisions and it is not responsible for them.

To the fullest extent the law allows, FinStream has no liability to you or to anyone claiming through you arising out of or relating to the service or this agreement, whether in contract, tort (including negligence), breach of statutory duty or otherwise. This includes direct loss as well as indirect, incidental, special, consequential and punitive loss, lost profits, lost revenue, lost data, lost goodwill, and any loss caused by a third-party service you connected, by an AI assistant you connected, or by inaccurate extraction, matching, coding, tax or reporting output.

Nothing in these terms excludes liability that cannot be excluded by law. Where the law does not allow the exclusion above to apply in full, our liability is limited to the greatest extent the law does allow.

13. Indemnity

You shall defend, indemnify and hold harmless FinStream, its affiliates, and their respective officers, directors, employees, contractors and agents from and against any and all claims, demands, actions, proceedings, liabilities, losses, damages, judgments, settlements, penalties, fines, costs and expenses (including reasonable legal fees) arising out of or in connection with: (a) your or your users' access to or use of the service; (b) any content, records or data you or your users submit to or process through the service; (c) any breach of these terms or of applicable law by you or your users; (d) any act or omission of a third-party provider or AI assistant you have connected to the service; and (e) any decision, approval, payment, filing or accounting entry made by or for your organisation in reliance on the service or its output.

FinStream assumes no duty to defend, indemnify or hold harmless you or any third party in any circumstance, and no such duty shall be implied from these terms, from the service, or from any course of dealing. We may, at our election and at your expense, assume exclusive control of the defence and settlement of any claim subject to indemnification by you, and you shall cooperate fully with us in that defence. You shall not settle any such claim in a manner that imposes any obligation, liability or admission on FinStream without our prior written consent.

14. Term, suspension and termination

• These terms run for as long as you have a FinStream subscription or an account.
• Either party may terminate for material breach if the breach is not cured within 30 days of written notice.
• You may stop using the service at any time; fees already due remain payable.
• We may suspend or terminate immediately where required by law, where non-payment persists after notice, or where continued use threatens the security or lawful operation of the service.
• On termination your access ends. We will make your data available for export for 30 days, and will then delete or return it in line with the privacy policy and any retention instruction you have given us.
• Sections on your data, our intellectual property, confidentiality, disclaimer, your responsibility and our exclusion of liability, indemnity and governing law survive termination.

15. Changes to these terms

We may modify, supplement or replace these terms at any time and at our sole discretion, without prior notice to you. The version published at finstream.app, bearing the effective date shown at the top of the page, is the version in force. Your continued access to or use of the service after a modified version is published constitutes your acceptance of it. If you do not accept a modification, your sole remedy is to stop using the service.

16. Governing law and disputes

These terms are governed by the laws of Singapore, without regard to conflict-of-laws rules, and the courts of Singapore have exclusive jurisdiction. Before starting proceedings, each party will raise the issue in writing and give the other 30 days to resolve it in good faith. Either party may seek injunctive relief at any time to protect its intellectual property or confidential information.

17. General

If any provision of these terms is held to be invalid, illegal or unenforceable in any respect, that provision shall be limited or severed to the minimum extent necessary, and the validity, legality and enforceability of the remaining provisions shall not in any way be affected or impaired.

18. Contact

• Product, account and billing — [email protected]
• Security vulnerabilities — [email protected] — see https://www.finstream.app/security
• Postal address — 111255 PTE. LTD., 160 Robinson Road, #14-04 Singapore Business Federation Center, Singapore 068914

1. Reporting a vulnerability

Email [email protected]. This mailbox is monitored by the FinStream engineering team and is the single intake point for security reports — from customers, from independent researchers, and from platform partners including Anthropic.

A report is most useful when it includes:

• What you found, in one or two sentences.
• The exact URL, endpoint or assistant tool involved.
• Reproduction steps, and the account or organisation you used.
• What an attacker could achieve, and any evidence (a request/response pair, a screenshot, a short recording).
• How you would like to be credited, if you would like to be.

Please send security reports only to [email protected], not to the support mailbox and not through a public channel, so that a fix can ship before the issue is known. If you need to send a report encrypted, email us first and we will arrange a channel.

2. What to expect from us

• We acknowledge every report from a human being within 3 business days.
• We tell you whether we can reproduce it, and our assessment of severity, within 10 business days.
• We keep you updated while we work, and we tell you when the fix is deployed.
• We will credit you if you want the credit, and we will not name you if you do not.
• FinStream does not currently run a paid bug-bounty programme. We will say so plainly rather than leave a reward implied.

3. In scope

• The FinStream web application and its API at finstream.app and www.finstream.app.
• The supplier portal and the invitation and onboarding flows.
• The AI-assistant connector endpoint and its OAuth handshake.
• Anything that lets one organisation reach another organisation's data, lets a user exceed their role, or bypasses an approval, payment-release or accounting-close control.
• Authentication, session, token and password-reset weaknesses.

4. Out of scope, and things we ask you not to do

• Do not access, modify or exfiltrate data belonging to anyone but yourself. If you reach another organisation's data accidentally, stop, tell us, and delete what you retrieved.
• Do not run denial-of-service, volumetric or brute-force tests, and do not attempt to degrade the service for other customers.
• Do not social-engineer our staff, customers or suppliers, and do not attempt physical access to any facility.
• Do not test third-party services we depend on (our hosting, database, email, accounting or payment providers) — report those to the provider concerned.
• Reports that consist only of an automated scanner's output, a missing best-practice header with no demonstrated impact, a self-inflicted issue, a rate-limit observation, an outdated-browser dependency, or theoretical email spoofing on domains that publish a reject policy, will be closed with thanks and no action.

5. Safe harbour

If you make a good-faith effort to follow this page — you stay within scope, you avoid other people's data, you do not degrade the service, you give us reasonable time to fix the issue before disclosing it, and you do not extort us — then we will treat your research as authorised, we will not pursue or support a claim against you over it, and we will say so if a third party raises one. If you are unsure whether something is in scope, ask us first.

6. How FinStream protects customer data

• Encryption — Every connection is HTTPS. Data is encrypted in transit and at rest by our database and object-storage provider. Third-party credentials, such as an accounting connection's OAuth tokens, are encrypted with a dedicated key before they are stored.
• Tenant isolation — Every request is authorised server-side against the caller's organisation, company and role, and the database enforces organisation-level row-level security underneath as a second, independent layer. Neither layer is relied on alone.
• Authentication — Sessions and API tokens are asymmetrically signed (ES256) and verified against the published key set on every request. Assistant connections use OAuth 2.1 with PKCE; a user authorises their own assistant and can revoke it at any time.
• Authority separation — Spend approval, tax review, treasury release and accounting close are separate capabilities held by named people. Amounts above a configured threshold need two different approvers in sequence. No automated path grants any of these.
• Assistant surface limits — A connected assistant can read records and draft documents. Approving, releasing a payment, posting or closing a period, and deleting records are not available to it at all — those verbs do not exist on the connector. Every assistant call is rate limited per user and recorded.
• Audit trail — Approvals, submissions, issuances, releases and voids are recorded append-only with the acting user and timestamp, and are not pruned. Assistant tool calls are recorded with the tool name, the outcome and a SHA-256 hash of the arguments — never the arguments themselves — and those telemetry rows are purged automatically after 365 days.
• Secrets and access — Application secrets are held in the hosting platform's encrypted environment store, never in source control. Access to production data is limited to the people who need it to run the service.
• Change control — Changes ship through version control with automated type checking, linting, an automated test suite and architectural boundary rules that fail the build when a layer boundary is crossed.

7. Machine-readable contact

Our RFC 9116 security contact file is published at https://www.finstream.app/.well-known/security.txt and points at this page and the mailbox above.

8. Contact

• Security reports — [email protected]
• Everything else — [email protected]
• Postal address — 111255 PTE. LTD., 160 Robinson Road, #14-04 Singapore Business Federation Center, Singapore 068914