Customer Data Ownership and Security

1. Your data is yours

You own all Customer Data: every deal record, document, model, rent roll, investor record, contact, note, chat, and output. T.HESIS claims no ownership of it. We receive only the permission needed to run the Service for you.

2. What we do with it

We store and process Customer Data only to provide, secure, and support the Service, as you direct.

3. Who can see it

• Inside your firm. Your administrators decide who sees what. Members see only the deals and rooms in their scope.
• Other customers. They can never see your data. Every request is checked against your organization.
• T.HESIS personnel. They do not view Customer Data except:
  • when technically necessary to keep the Service running or secure;
  • to provide support you request, limited to what is needed;
  • when the law requires it; or
  • with your written permission.

Any such access is limited to named personnel and is logged. We will tell you about access for the first or third reason unless the law prohibits it.

4. No selling or brokering

We will never sell, rent, license, broker, or trade Customer Data or anything derived from it. We will never use it to source deals, contact your counterparties or investors, or compete with you.

5. No AI training

We do not use Customer Data to train or fine-tune AI models. We send it only to AI providers whose terms or settings prohibit training on it, and we use their zero or limited retention options where they are available.

6. Aggregate usage information

We may use technical usage information to run and improve the Service. It never includes the contents of your deals or documents, and it never identifies you.

7. Security measures

During your subscription we will keep protections at least this strong:

• encryption in transit, and encryption at rest through our providers;
• private documents served only through links that expire after 5 minutes;
• multi-factor authentication for administrators;
• role-based and per-document access controls;
• audit trails for data rooms and administrative actions; and
• secrets kept on the server only.

We do not currently hold a SOC 2 or ISO 27001 report. If that changes, we will say so here. To report a security issue, email drobertson@thesisportal.com directly.

8. Subprocessors

We use the subprocessors listed in our Privacy Policy and hold them to written data protection terms. We remain responsible for them. We will give [30] days' notice before we add one that processes Customer Data.

9. Incident notice

If we confirm unauthorized access to Customer Data, we will:

• notify your administrators within 72 hours of confirmation;
• describe what happened and what data was involved, as we learn it;
• contain the incident; and
• cooperate with any notices you must give.

10. Regulated customers

If you are subject to SEC Regulation S-P or the Gramm-Leach-Bliley Act, we will sign a data protection addendum on request and answer reasonable security questionnaires.

11. Cancellation and deletion

• For 30 days after your subscription ends, you can export your data. On request, we will provide a copy of your uploaded files.
• After that, we delete Customer Data from active systems within [30] days and from backups within [90] days, and we confirm in writing on request.
• You may ask for earlier deletion at any time.
• We keep only records the law requires, such as billing records. We never keep deal or document content.

12. Legal requests

If a government or court asks for Customer Data, we will direct the request to you where possible. We will notify you before we disclose anything, unless the law prohibits it, and we will disclose only what the law requires.