This page describes how FinHelm handles access to your financial information. It states what FinHelm does. It does not list certifications FinHelm does not hold, and it does not describe controls FinHelm has not verified.
Read-only access
FinHelm reads from a connected financial system only under an authorization you grant through that system's own authorization process. FinHelm's access is read only. FinHelm does not write to, modify or post entries in a connected financial system.
FinHelm currently connects to QuickBooks Online.
You control the connection
You can revoke FinHelm's authorization at any time through the provider of the connected financial system, or through the Service where FinHelm makes that functionality available. On revocation FinHelm stops using the revoked authorization.
What FinHelm retains
FinHelm stores what you author in FinHelm, the forecasts it computes for you, and the normalized periodic actuals and provenance records needed to score them. Ledger reads are not copied beyond that, and FinHelm never writes to your accounting system. The scope of FinHelm's rights in your data is set by Section 7 of the General Terms of Service, and FinHelm's handling of information is described in the Privacy Notice.
Where FinHelm runs
The finhelm.ai site and application front end are delivered by Vercel. Vercel also runs FinHelm's server functions, including those that handle sign-in and authorization, connected financial systems, billing, planning and enquiries submitted through the site. Those functions are deployed in a United States region. Vercel receives and routes requests through its global network, and FinHelm's routing middleware for signed-in application pages, which checks sign-in sessions, is deployed in Vercel regions inside and outside the United States.
Amazon Web Services hosts parts of FinHelm's application, provides FinHelm's account sign-in service in the United States, and stores records the application writes, such as account profiles, lead records and planning inputs.
The keys FinHelm uses to sign its own authorization tokens and sign-in sessions, and to encrypt the sign-in tokens it stores, are held in FinHelm's Vercel project configuration and are used by FinHelm's server functions and routing middleware on Vercel. The encrypted sign-in tokens are stored in Amazon Web Services.
The canonical list of FinHelm's service providers is in the Privacy Notice; this page does not maintain a separate list.
Analytics and session replay
PostHog: Product analytics, processed in FinHelm's U.S. PostHog project, is on by default on selected website and product pages unless you have declined it or enabled Do Not Track or Global Privacy Control. We collect visits, clicks, form change or submit actions without entered values, scrolling, page time and exits, and heatmaps. Visitor profiles include browser/device details and user-agent strings, IP address, approximate location and visit sources. After a confirmed contact submission with analytics allowed, we link visits to the submitted email and available contact and company details. Visits linked to an email when a visitor previously saved an assessment with analytics allowed are part of that visitor's profile. Verified sign-ins with analytics allowed use stable account identifiers. Server tracking records confirmed lead saves, account visits, billing and email delivery outcomes, sanitized errors and tool-call timings. Saved lead and account choices control later linked server events.
Session replay is enabled for all eligible sessions. Recordings include page layout, public text and interactions, with all form values masked. Text in signed-in product pages and financial or user-content areas of the assessment is masked; embedded frames, canvases and designated private visualizations are blocked. Sign-in and other excluded pages, financial inputs and results, ledger data, message bodies, payment credentials, passwords, sign-in tokens, console logs and network request or response contents are excluded. Tool diagnostics exclude prompts, arguments and results. Use Privacy choices on the Privacy Notice page to allow or decline analytics and recording. Your saved browser choice remains until you change it or clear browser storage. Clearing browser storage removes the local choice, while a saved account decline can apply again at sign-in. Separately, limited public-request delivery records use hashed client identifiers without person profiles and exclude private routes, queries, bodies and runtime messages. See Section 9 of the Privacy Notice for details.
Google Analytics: Analytics is enabled by default on selected public marketing pages, using the same Privacy choices and browser privacy signals. Assessment, account and sign-in pages are excluded. We send predefined page names and confirmed contact submissions, with a limited product-tier category. Google may also process browser/device information, session activity and approximate location. Its first-party identifier cookies are configured to expire after 180 days without refreshing that period on a visit. Form contents, financial values, account identifiers, raw query strings and referring URLs are excluded. See Section 9 of the Privacy Notice.
Enterprise requirements
Command contracting, security and data-governance requirements are scoped during the sales process.
Reporting a concern
If you believe you have found a security issue affecting FinHelm, contact legal@finhelm.ai with enough detail for FinHelm to reproduce it. Please do not access, modify or retain data that is not yours while investigating.
Version and effective date
Version 1.1. Effective September 27, 2026.