Your clients’ books are never our training data.
Built to the standard your engagement letters promise. Below is what that means concretely - the commitments, the access model, and the compliance posture, including the parts that are still in progress.
The four commitments.
These are the ones stamped on the delivered close, and they mean what they say.
Never trained on
Bursar data policy · absolute. Client financials are processed to produce your close. They are not used to train models.
AES-256 encrypted
At rest and in transit.
Every action logged
A full audit trail. Every touch on a close is recorded immutably - who, what, and when.
Deleted in 30 days
Of offboarding. Yours to export before then.
Posture, as of today.
In more detail.
Three pages rather than one long one, because a security review reads them separately.
Two rules govern this, and they do not bind the same party.
Bursar’s production capability includes people outside the United States. That is a fact with a legal consequence, so it is designed for rather than glossed.
- IRC §7216 binds Bursar. Disclosure of a taxpayer’s return information to someone outside the United States requires that taxpayer’s signed consent, in a prescribed form, before any disclosure. Bursar will not open a close for a client until that consent exists - the gate is in the software, not in a checklist.
- A consent is stored as the text that was actually agreed, with the date it was signed and when it expires, because a boolean records that somebody clicked and only the text records what they agreed to.
- A revoked consent is stamped, never deleted. The question a regulator asks is whether you were permitted on the day you disclosed, and a deleted row cannot answer it.
- AICPA ET 1.150.040 binds your firm: you must tell your client that your firm may use a third-party service provider before disclosing their information. You do not have to name us. If the client objects, Bursar treats that as dispositive and refuses disclosure for that client.
The security pack
There is no self-serve download, because there is no packaged document to give you that would not go stale between the day it was written and the day you read it. Email hello@trybursar.com and say which review you are running - a vendor questionnaire, a client diligence request, a partner’s sign-off - and you will get answers to that, current as of the day they are sent.
Send us your questionnaire.
You will get it answered directly, including the parts where the answer is “not yet”.