Data protection: a note for your compliance officer

One page on where a client's data goes when an adviser uses the program. It can be printed for the firm's file. It describes the program; whether it meets the firm's own obligations is the firm's assessment.

Where the data is

• On the adviser's computer only. The program runs on that computer and opens in its browser at http://127.0.0.1:8766/, an address only that computer can reach. There is no setting that opens it to a network.
• Nothing is sent anywhere. No client data, no usage figures, no update checks. It works with the network switched off. The test suite runs a client, its plans, the brief and the verification pack through the program and fails if any of it writes a file or opens a connection off the computer.
• While it runs, the client being worked on is held in the program's memory, with the form's unsaved draft, the plans kept in the meeting and the notes typed on the brief. Closing the program clears it.

What is written to disk

• A client's saved answers, only when the adviser saves them, to a file and folder the adviser chooses. The brief and the verification pack are printed or saved as PDF the same way.
• A saved file can be locked with a passphrase. The answers are encrypted with AES-256-GCM under a key drawn from the passphrase with PBKDF2-SHA256 (600,000 rounds). The passphrase is never stored, so a file whose passphrase is lost cannot be opened, by the adviser or by us. The file's name, and the client's own folder it is saved in, carry the client's name and the date, so they show who it is about even when the file is locked.
• The program's own settings, in a folder named .alm in the adviser's home folder: the licence, the trial's start date, the firm's name and logo for the brief, and the firm's own market assumptions with their earlier versions; and a second copy of the trial's start in the computer's folder for applications' data, under IrishALM. None of these holds client data.
• The browser remembers whether the timeline bar is folded, whether the first-run welcome and the question about a client folder were put away and, in Chrome and Edge, which folder client files are saved to and the folder last saved to. Nothing about a client.

What we receive

To licence a computer, the adviser emails us its licence ID: 32 letters and numbers derived from the computer's own identifier by a one-way hash, so it is not the hardware serial. We send back a signed licence, which the program checks on the computer. Besides that email, we receive nothing: no client's name, figures or files ever reach us.

Backups and deletion

• Back up the folder where client files are saved with the firm's usual backups. A locked file stays locked in the backup.
• Delete a client's data by deleting their saved file, and any brief or pack saved from it. Removing the program leaves the .alm folder and saved clients in place; delete them by hand to remove them.
• A lost or stolen laptop exposes only what is saved on it: lock client files with a passphrase, and keep the computer's own disk encryption (BitLocker or FileVault) switched on.

Not advice

The program models the client's own choices and recommends no product. The advice, and the record of it, remain the adviser's.