AdvoloTech
Security & Data Policy
How Advolo handles firm and client information on a recommendation-only platform for held-away accounts.
Last updated October 4, 2026, version 1.0
01 — Scope
What this policy covers
AdvoloTech operates Advolo, a technology platform for registered investment adviser firms that advise on held-away accounts, such as a 401(k), 403(b), HSA, or 529. Advolo is the technology provider. Advolo is not an investment adviser, a broker-dealer, or a custodian.
The platform is recommendation-only. A client can provide the fund names in their own account. An advisor sends back an allocation recommendation. The client decides whether to act, and places any trades in their own account. Advolo does not take custody of assets, does not place trades, and does not receive authority to trade.
This policy describes the controls that are in place today, and the retention schedule we operate to. It is version 1.0. Outside counsel will review the wording. A later version will replace this one. We do not rewrite an acceptance after it is recorded.
02 — Collection
Information we collect
From a firm applying to join: the applicant’s name, email, and phone; the firm’s legal name and any DBA; the firm’s CRD number; the applicant’s role; what the firm hopes to use Advolo for; a time for a verification call; and the consent recorded on the application.
After a person approves the firm: the firm profile (legal name, CRD, principal office address, and phone), a compliance contact, a billing-contact placeholder, an optional display name, and which people at the firm may invite advisors. Billing is not connected. The billing contact is stored for a later setup and does not create a payment account.
Client onboarding is not open yet. When it is, a client will be able to provide the fund names in a held-away account so an advisor can prepare a recommendation. We will store those fund names. We will not ask for an account number or a Social Security number in order to do that.
We also keep sign-in records, the version of each policy or agreement a person accepted, and the append-only audit log described below.
03 — Limits
Information we do not collect
We do not collect Social Security numbers. We do not collect brokerage, plan, or custodian account numbers. We do not collect usernames, passwords, or other credentials for a client’s account.
Advolo does not log in to client accounts. Advisors do not log in to client accounts through Advolo. The platform has no trading authority and no custody of client assets.
04 — Use
How we use information
We use firm and client information to review an application, to operate the recommendation workflow, to keep the audit record, and to run the service. A firm’s information is used for that firm.
We do not sell personal information. We do not use it for advertising. We do not share a firm’s information with another firm. We share it with the vendors below, who process it for us, and when the law requires a disclosure.
05 — Review
Public-source checks, then a person
Before a firm is approved, we run public-source diligence checks. Those checks look at public registration and Form ADV information, and at whether the applicant appears to have authority to act for the firm. We also contact the firm for a verification call.
A person approves or declines the firm. The checks cannot approve, decline, or confirm a firm. Approving against a “not confirm” result requires a written reason, and that reason is stored.
06 — Access
Who can see a firm’s data
Access is least-privilege and role-based. A client is limited to their own records. An advisor is limited to their own clients. A firm’s chief compliance officer and firm administrators see that firm. Advolo operators see the platform records their role allows. An applicant has no account.
One firm cannot read another firm’s rows. The database enforces that separation with row-level security on the firm identifier. Hiding a screen is not the control. The database is.
07 — Record
The audit log
Every state-changing action writes one row to a single append-only audit log. The row records the action, the time, and the person who did it. An applicant has no account, so that row is tied to the applicant rather than to a user id. Operator actions that are not inside one firm are stored without a firm id, and the new firm’s id is in the payload when a firm was just created.
Application roles cannot update or delete audit rows. An accepted agreement is not edited. The row keeps the version the person accepted, the time, and who accepted it.
08 — Encryption
Encryption in transit and at rest
The application is hosted on Vercel. The database, sign-in, and file storage run on Supabase. Pages are served over HTTPS. Vercel states that it encrypts data at rest with AES-256 and in transit with TLS. Supabase states that customer data is encrypted at rest with AES-256 and in transit with TLS.
Those are the providers’ controls. Advolo does not operate a separate encryption layer of its own. We rely on Vercel and Supabase for encryption in transit and at rest.
09 — Vendors
Vendors and subprocessors
In use today: Vercel (hosting), Supabase (database, authentication, and file storage), and Resend (transactional email, such as an application confirmation).
Planned, and not in use for firm or client data today: Stripe, when billing launches. An e-signature provider, when client agreements are signed through one. Today a firm uploads its client packet as a PDF. There is no e-signature step, and no payment account is created in the product.
10 — Retention
How long we keep records
Records we hold for a firm about recommendations, agreements, and client acknowledgments: for the advisory relationship, and for 7 years after the later of the end of that relationship or the fiscal year of the last entry.
Our own vetting file for an approved firm: for the relationship and 10 years after it ends. An application we do not approve, including the decision: 10 years from the decision. The firm’s acceptance of our agreements: for the term of the relationship and 10 years after.
Audit log entries are kept for the same period as the record they belong to. Platform entries that do not belong to a firm record are kept for 10 years.
A request to delete information does not override a period that still applies. Removing a row from the application database does not, by itself, erase every copy a hosting provider may keep in a backup. We do not run a separate certified-destruction process today.
11 — Incidents
If something goes wrong
If we learn that someone gained unauthorized access to a firm’s or a client’s information, we will notify that firm’s compliance contact, describe what we know, and keep a record of the notice. The firm can then meet its own notice duties to clients.
We do not publish a fixed number of hours for that notice. We will not wait on a finished investigation before telling the firm that an incident involves its data.
12 — People
A person approves
A person at Advolo approves or declines a firm before an account is created. The public-source checks do not. A firm stays in onboarding until the required setup is finished, including the Platform Agreement and the Security & Data Agreement accepted by the firm’s chief compliance officer, and until a person at the firm approves the client packet.
Advisor invitations stay off until the firm is live. A person at the firm sends an invitation. Advolo does not create an advisor account from the application alone.
13 — Contact
Security Officer and reports
The Security Officer is Mason, the owner of Advolo. This policy is approved by the owner.
Report a vulnerability or a security question to hello@advolo.com. Please include enough detail for us to reproduce the issue, and give us a reasonable time to respond before any public disclosure.
The security program is designed with SOC 2 in mind. We plan an independent audit. Advolo does not currently hold a SOC 2 report.
Read the acknowledgment wording used on the application, at account creation, and in firm setup.