Your Family Financial Hub
A family’s whole financial picture, built from their own papers.
An adviser firm gives each client household a hub. The family’s documents go in and are read into records, each one carrying the sentence it came from. The family sees what is there and what is missing, and shares it with the people they choose. The firm sees which households need them next.
What it does
Reads the paperwork
Wills, pension statements, policies, valuations, fact finds, letters. PDFs, including scanned ones, Word, Excel and PowerPoint files, and photographs of documents, up to 5MB each. Each document becomes records a person can read, and each record keeps the sentence in the document it was taken from.
Shows what is missing
The family’s front page says how ready they are and what would change it: no will recorded, no lasting power of attorney, a pension with no beneficiary named, a record missing a detail its kind should have. It is a list of things to do, not a score.
Asks rather than guesses
When a document leaves something unclear, such as who owns an account, what date a will was signed, or how two people are related, the hub asks a question instead of filling in an answer. An unknown owner stays unknown until somebody says.
Shares as far as the family chooses
Records sit in six categories: legal, tax, income, wealth, health and identity. Each person the family invites, a son, a solicitor, an accountant, is given the categories the family decides and sees nothing else. Access can be taken back at any time.
For advisers
A book ordered by who needs you
The firm’s home screen ranks households by how long the oldest unfinished thing in each has been waiting: readings to confirm, open questions, missing details, a hub nothing has been read into. Not by wealth, so it is not the same list every morning.
Nothing is confirmed until you confirm it
Every reading waits for the firm. Approve it, reject it, or correct it; a correction keeps the original reading and its source alongside, so the history of a figure is never lost. Until then the family sees it marked as not yet confirmed, including inside any total it is part of.
Your firm's name on it
Each firm has its own address, its own sign-in page and landing page with its logo, its own name for the assistant, and its own privacy policy. The families you look after see your firm, with the software named once in the footer.
The work around the relationship
Meetings, messages and updates with the household; a family tree the family can correct; goals worked back to what they need at each point; and calculations such as an inheritance tax estimate, whose formula is tested against HMRC’s own published worked examples and which says whether you have reviewed it for that household.
For families
Their own site
A hub is laid out for the household from what their papers say: a home page, pages for their money and their family, their family tree and their own photographs, under their family’s name.
An assistant that can rearrange, not invent
They can ask the assistant where something is, or ask it to change how their pages are laid out, and undo that if they do not like it. It cannot write a figure: anything it suggests adding waits for the firm like any other reading.
Theirs to take
A household’s whole record can be exported, every record and every document with the data behind them. A household can be deleted, which removes its records, its documents and the files behind them.
Where the figures come from
Documents are read by Anthropic’s Claude. What it produces is checked by code before anything is recorded, and three rules hold everywhere:
- Every reading shows its source. A record opens to the document and the sentence it came from. A figure or a date that is not in the lines the reading points to is not recorded; it becomes a question.
- The AI never adds anything up. Every total, count and comparison on screen is worked out by ordinary code from the records. The AI decides what goes on a page and where, and the numbers come from the records.
- A reading is a reading until a person confirms it. It can be wrong, which is why it waits for the firm, and why the family can see which figures are confirmed and which are not.
Security and privacy
Each firm kept apart
Every firm has its own database and its own encryption key. There is no shared table of clients: a request is tied to one firm from the signed-in session, and reaching a second firm is refused by the software rather than filtered out of a result.
Encrypted value by value
Names, figures, filenames, document contents and the messages people write are each encrypted with AES-256-GCM before they are stored, not only the disk they sit on. A firm’s key is itself encrypted with a master key that is never kept on the same disk as the data. Everything travels over TLS.
Signing in, and who sees what
Passwords are stored as scrypt hashes, and anyone can add an authenticator app as a second step. Permissions are applied when data is read, not when a screen is drawn, so a screen cannot show what its viewer is not allowed to see.
A record of every act
Every change to a household’s records writes down who did it and when. Those entries cannot be edited or deleted; the database itself refuses. Backups are taken nightly, held off the server, and are copies of files that are already encrypted. Thirty nights are kept.
Who else touches the data
- Anthropic reads uploaded documents to turn them into records. This is the one place a client’s papers leave our systems. It is processed in the United States under Anthropic’s data processing terms, which include the UK International Data Transfer Addendum, and is not used to train their models. Scanned pages are converted to text on our own server first.
- Hetzner runs the server, in Germany, and Cloudflare stores the nightly backups, in the European Union. Both hold only encrypted files, and no key to them.
- Brevo sends email, from the European Economic Area. It is used for messages people ask for, such as a password reset, never for marketing, and nothing sent is tracked.
Nothing in a hub is sold, shared, or used to train any model. The site sets one cookie, the one that keeps a person signed in, and runs no analytics. Under UK GDPR the firm is the controller of its clients’ data and Independent Check Ltd is the processor; the data processing agreement every firm accepts sets this out clause by clause.
What it is not
- It does not give advice. Where it works something out from a family’s records it says so, and says to speak to their adviser before acting on it.
- It does not connect to bank or pension accounts. It knows what the documents say, as at the date they say it.
- It is not always right. A reading of a document can be wrong or incomplete, and handwriting is not read reliably. That is why every reading shows its source and waits for a person.
Run an adviser firm?
Write to us and we will show you a hub built from real paperwork, and set your firm up if it suits you.