Harmonious Data Security

Data Protection

Fund and investor records are treated as official once saved, not as a draft anyone can quietly overwrite.

• Protected saved records use controlled change requests rather than silent overwrites. Signed agreements retain their original versions and history.
• Where separation of duties applies (fee terms, documents, distributions) a different person must sign off before anything takes effect.
• Any exception to separation of duties requires specific authorization and a permanently recorded written reason.
• Access changes, including changes that were refused, are written to an append-only log that cannot be edited after the fact.
• Tax identification numbers are stored encrypted. The app displays only the last four digits.

Identity & Access

Workspace access is protected by two-step authentication and permissions tied to a person's role and assigned records.

• Staff and client workspaces use authenticator-based two-step sign-in. Additional checks protect sensitive actions such as access to tax documents.
• If someone loses their second step, access is restored only after a documented identity confirmation process completed by Harmonious staff.
• Identity verification is tied to the person's own account. Qualifying identity checks under review may allow limited workspace access; banking, funding and money actions remain blocked until verification is fully approved.
• Access follows role and scope: a person sees the funds, clients and records they are responsible for. Extra permissions are granted to one named person and are never handed out because of an email domain.
• Access can be revoked, suspended or archived at any time, and each account's most recent sign-in is recorded.

Application Security

Protections are enforced by Harmonious servers, not only by what a screen shows or hides.

• Protected fund, investor and client requests are authorized on the server against the person's role and relevant record scope. Sharing a screen or changing web addresses does not grant authority.
• Signed-in pages use traceability measures so that shared or copied content can be attributed, and protection events are recorded.
• Access to tax documents uses additional authentication checks, and allowed and refused downloads are recorded.
• Sign-in and session activity is recorded so unusual access can be investigated.

Money Movement Controls

Harmonious prepares payment work; people release it.

• Harmonious does not automatically initiate a bank debit, wire, ACH transfer, tax payment or refund.
• Payment and distribution files are prepared inside the app and released only after a named person reviews them.
• Distribution workflows separate preparation and approval. Approval does not initiate a transfer.

Encryption

Information is protected while it travels to Harmonious and when the most sensitive details are stored.

• All Harmonious web addresses use HTTPS with a valid certificate. Connections support TLS 1.3 and TLS 1.2; TLS 1.1 and older are refused.
• Browsers are instructed to always use a secure connection with Harmonious (HTTP Strict Transport Security), including on subdomains.
• Tax identification numbers are stored encrypted, and screens show only the last four digits.
• The most sensitive identifiers used for entity formation receive additional encrypted protection beyond standard storage.

Bank Connections

Connecting a bank account is optional. Clients can upload wire instructions and bank statements instead. If you do connect, access is read-only.

• Before the bank sign-in window opens, you must be signed in with two-step verification (an authenticator app).
• You also check a consent box that links to our Privacy Policy and our connection partner's privacy policy. We record your consent before the connection starts.
• Your bank login details go straight to our connection partner and your bank. Harmonious never sees or stores them.
• The connection access key is kept on our servers and never reaches your browser.
• We use the connection to read account details, balances and deposits so payments can be matched. We never use it to move money, and we never sell this data.
• You can disconnect at any time from Banking. Bank-connection data is kept while you're connected. When you disconnect or ask us to remove it, we delete it, unless a legal or regulatory hold applies. A person reviews and logs every deletion.
• Our written Information Security Policy covers bank connections and is reviewed every year. Ask support@harmonious.co for a copy.

Privacy

You can ask us what we hold about you, ask us to fix it, or ask us to remove it.

• From Account -> Privacy you can request a copy of your data, a correction, or deletion.
• Privacy requests open a staff review task with a 30-day response target; fulfillment is handled by a person, not an automatic deletion job.
• Deletion never removes financial, tax, regulatory or legal records we are required to keep, we tell you what was kept and why.
• How we collect and use personal information is described in our Privacy Policy.
• A list of the service providers we rely on is available by asking support@harmonious.co.

How long we keep records

Every record family has a written retention rule in our Compliance & Controls register. Nothing is deleted automatically, a person reviews each disposition, and a legal or regulatory hold blocks it.

• Tax records (K-1s, filings, workpapers): 7 years after the return is filed.
• Fund formation and offering documents (PPM, operating agreement, subscriptions): the life of the fund plus 7 years after dissolution.
• Investor identity and verification data: 7 years after the investor relationship ends.
• Fund books and accounting records: 7 years after the period they cover.
• Signed agreements: 7 years after the agreement ends; the append-only activity history is kept for the life of the platform.
• Marketing contacts: until consent is withdrawn, then 3 years as proof of consent.

Cookies and your consent

Our public pages ask before using any optional cookies. You can change your choice at any time with the Cookie settings button below or in the footer.

• Strictly necessary cookies keep the site working and secure and are always on.
• Preferences, Analytics and Marketing cookies stay off until you turn them on.
• Rejecting optional cookies is as easy as accepting them, and your choice is saved only in your browser.
• We do not currently run analytics or advertising trackers on our public pages.

Trust documents

No trust documents are currently published. For a due-diligence questionnaire or supporting security information, contact legal@harmonious.co. Availability and access are reviewed individually.

Common security questions