Security

Privacy, security, and compliance posture.

Protocol Wealth is an SEC-registered investment adviser. This page summarizes how we protect client information, supervise AI-assisted workflows, manage vendors, and preserve required records.

Last reviewed September 25, 2026. The linked PDF is the current public posture artifact for website use.

Book a discovery call Download posture PDF (2026-09-25)

This is a public summary, not an exhaustive control report, SOC 2 report, ISO certificate, penetration-test report, client agreement, or replacement for our Form ADV, Privacy Notice, Terms of Service, or other required disclosures. We state material limitations plainly because public security communications should be fair, balanced, and verifiable.

Core commitments

What clients and reviewers should know first

Client data is not sold or used to train AI models.

Vendor relationships are limited to providing services to the firm and are governed through our Privacy Policy, Subprocessors Inventory, and vendor due-diligence process.

Human advisers remain accountable.

AI assists with research, monitoring, summarization, and drafting. It does not make final investment decisions or send client-facing advice without human adviser review.

Access is restricted, and changes are logged.

Client data access is role-restricted and isolated by database row-level security. Actions that create, change or delete client data are written to an audit log under the firm's books-and-records program.

Required records are retained.

Actions that create, change or delete client data are written to an audit log. Audit records are mirrored to a Google Cloud Storage archive whose retention lock is seven years and cannot be shortened.

Privacy and AI controls

AI is supervised and data-minimized.

Our primary reasoning-model provider is Anthropic's Claude API under a contracted Zero Data Retention configuration. Under that arrangement, API inputs and outputs are not retained for training or model improvement, and inference is restricted to US-based infrastructure. Since September 22, 2026, advisers can also choose xAI's Grok in advisor chat. xAI is engaged under team-level zero data retention, our systems check that assertion on every response (the check runs after the request is sent), and requests go only to xAI's U.S. regional endpoints. Client information in such a conversation can reach xAI.

We also use narrower AI capabilities that are not client-facing: adviser-facing image/graphics generation and search indexing of documents added to advisor chat (Google Gemini, through Google Cloud's Vertex AI at U.S. endpoints). The AI assistant in the client portal, a limited beta on Claude, answers a client's own questions directly, without adviser review, and gives no investment advice. All of these are disclosed in our Privacy Policy and List of Subprocessors.

Client-data fields are classified at ingestion as high, medium, or low sensitivity. Before text is sent to an AI provider, our systems replace the identifiers they recognize with placeholders, such as government identifiers, account numbers, email addresses, phone numbers and dates of birth. Recognition is by pattern, is not complete, and does not remove names; PDF and image attachments are not scanned. An independent egress canary can block outbound requests when residual sensitive patterns are detected.

Controls

Current security controls

Data protection

TLS 1.2 or better for external traffic, with TLS 1.3 preferred.
Cloud SQL and Cloud Storage encrypted at rest with AES-256.
Application-layer AES-256-GCM protection for sensitive vendor credentials.
Private-network production Cloud SQL and Redis services.
Google Workspace Enterprise Plus for firm email, documents, and files, encrypted at rest with AES-256 under Google-managed keys, with Google Vault retention and eDiscovery.

Identity and isolation

Staff sign in through Google Workspace with two-step verification. Clients sign in with a passkey, Google sign-in, or a one-time link sent to their email address.
Passkey-first authentication on newer client onboarding flows.
Database-enforced row-level security for tenant isolation.
Workload identity for non-human access; long-lived service-account keys disabled.

Monitoring and response

Cloud-configuration-change alerts for high-risk GCP changes.
Google Security Command Center findings feed our operational security work.
Dependency scanning, code scanning, and PII-egress alerts.
Written incident response plan and post-incident review process.

Records and vendors

Canonical audit log for state-changing actions.
Seven-year, append-only WORM archive for audit records. Protocol Wealth's own recordkeeping obligation as an adviser is SEC Rule 204-2.
Subprocessor review before onboarding and periodically after that.
Vendor diligence evidence available under NDA where redistribution terms permit.

Digital assets

Onchain wallets: who holds the keys.

The self-custodial wallet in the client portal, built on Turnkey, is being offered first to selected clients. Clients it is offered to can turn it on in the client portal. The client is its sole owner, and it is secured by the client’s passkey. Protocol Wealth never holds the private key, can never sign on the client’s behalf, and does not recover wallets, so the portal asks each client to add a backup passkey on another device.

For active onchain strategies, Protocol Wealth may also operate a whitelist-bounded managed sleeve on Fordefi MPC wallet technology. The client administers the wallet's Rules Policy and holds final approval; Protocol Wealth can transact only to client-pre-approved addresses and contracts (which may include third-party DeFi contracts) and cannot add destinations or move assets outside that whitelist. Signing authority is divided into cryptographic shards: Fordefi holds one shard and Protocol Wealth holds one shard. The client holds the ultimate backup, and Protocol Wealth cannot recover the wallet on its own. Fordefi is wallet technology, not a qualified custodian.

Compliance framework

Regulated adviser obligations come first.

Protocol Wealth's security program is designed around its obligations as an SEC-registered investment adviser, including Regulation S-P safeguards and breach-notification readiness, Rule 204-2 books and records, fiduciary supervision, and Marketing Rule review for public communications.

Our Regulation S-P posture is to maintain reasonable measures to safeguard client information and to provide any legally required breach notification without undue delay, within the deadlines set by applicable law and regulation. We do not represent a fixed contractual 72-hour notification clause; internal response targets do not override the deadlines the rule actually sets.

The firm maintains an ISO/IEC 27001:2022-aligned Information Security Management System with a Statement of Applicability and Risk Register. This is an internal control framework and diligence artifact. Protocol Wealth is not ISO 27001 certified.

Protocol Wealth does not currently hold a firm-level SOC 2 report. We rely on vendor SOC 2 reports where appropriate and maintain a readiness path in case a future customer, partner, or commercial need justifies a firm-held SOC 2 engagement.

Where FINRA standards are relevant through broker-dealer partners or public-communications discipline, we draft communications to be fair, balanced, and not misleading. Protocol Wealth does not present this page as a FINRA member communication unless separately approved through the appropriate channel.

Current limitations

What is not being claimed.

Customer-managed encryption keys (CMEK) and column-level field encryption are not in place.
No formal external penetration test has been completed.
No scheduled access-review cadence is in operation.
The independent PII egress check does not yet cover every API egress path.
Our PII scanning does not remove names, and PDF or image attachments in advisor chat are not scanned.
We have not yet obtained xAI's SOC 2 report for our vendor file.
ISO 27001 certification and a firm-level SOC 2 report are not current claims.

Verify

Diligence materials available under NDA.

Qualified partners and institutional reviewers may request supporting diligence materials, including vendor due-diligence evidence, anonymized audit-log samples, the ISO-aligned Statement of Applicability, the Risk Register, and security-policy artifacts.

Privacy and compliance[email protected]

Security reports[email protected]

Form ADV Part 2Aadviserinfo.sec.gov/firm/brochure/335298

Attestation

Current posture artifact.

This public security posture was last reviewed on September 25, 2026. The linked PDF is the current public posture artifact for website use.

Download the public posture PDF