Security

Six guardrails.
Every number sourced.
Every gap flagged.

The core differentiator: "Every number is sourced. Everything we can't confirm is flagged. We don't guess." AI never fabricates; uses company documents so underwriting remains the user's own.

Your deal data stays yours. It is never used to train public AI models.

"Every number is sourced.
Everything we can't confirm
is flagged.
We don't guess."

Source Discipline

Built in, not bolted on.

Six guardrails ensure Pursuit's output can be trusted at IC committee level. By construction, not by policy.

GUARDRAIL 01

Document-grounded extraction

All data originates from submitted documents. The AI does not infer or hallucinate values. Every figure comes from an uploaded file.

OM.pdf→ Cap Rate, NOI, asking price

rent_roll→ Occupancy, unit count, rent schedule

t12.xlsx→ NOI verification, expense ratios

GUARDRAIL 02

Source citation behind every number

Every value in the model cites a document name and page number. Every extraction preserves the verbatim snippet alongside the parsed value.

Cap Rate6.25%

SourceOM p.3, Investment Summary

Snippet"Going-in cap rate of 6.25% on Year 1 NOI"

GUARDRAIL 03

Red flag on unsourced data

Fields the AI cannot confirm from documents are flagged. Not filled with estimates. The analyst decides what to use. The model does not guess.

Loan AmountNOT FOUND : FLAGGED

Source⚠ docs silent : analyst to decide

Fabricated?NO

GUARDRAIL 04

Analyst review before export

The model is a working draft, not an auto-final deliverable. Every deal requires analyst review before export. Gap flags are visible, not suppressed.

StatusWorking Draft

Flags1 unresolved (Loan Amount)

ExportRequires analyst sign-off

GUARDRAIL 05

Full audit log

Every change is tracked, attributed, and timestamped. Every extraction session, model revision, and version output is logged with user ID and data fingerprint.

v1Extraction from OM.pdf : user: jane@firm.com

v2T-12 verified NOI : user: jane@firm.com

v3Cap rate adjusted 6.25% → 6.0% : user: admin

GUARDRAIL 06

Public data cross-check

If two different live public data sources contradict each other : and the conflict isn't explainable by recency (e.g., one source is 9 months older than the other) : Pursuit flags the discrepancy rather than guessing which one to use. The flag fires when both sources are current but contradictory.

Source A

Cap 6.8%

ATTOM Data

≠

Source B

Cap 5.9%

CompStak

→

⚠ Flagged

Discrepancy : analyst resolves

Flag fires when both sources are current but contradictory : not when one is simply older

Infrastructure

Isolated by design.

Each client organization runs in an isolated database partition. Audit logs capture user ID, timestamp, action, and data fingerprint for every operation.

◈

Tenant Isolation

Database-level access controls prevent cross-tenant queries. No deal, model, or document is accessible outside your organization.

🔑

Least-Privilege Access

Role-based access controls. Users get the minimum permissions needed. MFA for all production access.

🔒

AES-256 + TLS 1.3

AES-256 at rest, TLS 1.3 in transit. Cardholder data never touches our servers. Stripe handles PCI DSS Level 1 compliance.

Compliance & Certifications

Standards maintained.

SOC 2 Type II

Controls implemented per AICPA Trust Services Criteria. Type II audit in progress for Security, Availability, and Confidentiality.

Data Privacy

Your deal data stays yours and is never used to train public AI models. CCPA, CPRA, and GDPR compliant.

PCI DSS

Payment processing through Stripe. Cardholder data never touches our servers. Stripe maintains PCI DSS Level 1 compliance.

Six guardrails.Every number sourced.Every gap flagged.