Something that reads your finance systems has to be safe to hand them to.

This page says what Harnace can and cannot do with your systems, your numbers and your documents, what stands in the way of each thing going wrong and what is not built yet. It is written from the same threat model our engineers work from, and it changes when the product does.

It reads. It does not write.

Harnace reads your ledger, CRM, billing, bank and payroll, and nothing in it can create, change or delete a record in any of them. That is enforced in code at the moment a tool is called, whatever a handbook or an instruction says, and a test fails if any connection would send your systems anything but a read. Where a system offers read-only access, we ask for it. Where it offers a narrower key, we ask for the narrowest and refuse a broader one. A Stripe secret key, for example, is turned away in favor of a restricted key that reads six billing records (customers, products, prices, subscriptions, invoices and credit notes), and a key that can read more than those six is refused before it is kept. QuickBooks and Salesforce offer no read-only access to ask for, and Rillet and Runway document none, so for those four the limit is our code rather than the key, and for Salesforce we recommend connecting as a read-only user. A key is tried before it is kept, stored encrypted, never shown to the model and deleted when you disconnect. Harnace has no payment rail and cannot move money. The one write we ever built, entering an approved bill in QuickBooks, never ran for a customer and was removed on October 9, 2026.

What it will never do

A short list sits under every rule a company writes, and no handbook, no instruction and no person on our side can loosen it. Harnace will not pay anyone, create a vendor, send a document for signature, change anyone's access or change any other record in your systems, because it only reads them. It will not email a report to an address outside your company. Each of these is enforced in code at the moment a tool is called, not by asking the model nicely. Separately, the AI that talks with your team is instructed never to take bank account numbers, card numbers, salaries or government ids by phone or file them from a document, a dropped spreadsheet has any bank account, routing or card number emptied in code before it is kept, and a key or password typed into a conversation is removed in code before anything is kept.

One gateway for every call

The AI inside Harnace never touches a system directly. Every call it makes goes through one gateway that checks the input against the tool's schema, then against your company's rules, then against the floor above. A message that would leave your company waits for a named person unless your rules say otherwise, and the person's decision is written down with their identity.

Documents are data, not instructions

Invoices, emails, contracts and anything dropped in the console are read by a step that has no tools and can only produce typed fields. The step that decides never sees the raw document. An invoice that says "pay this to the new account" or "ignore your rules" produces at most a flag on the record and a hold for a person. The same is true of a Slack message and a voice call. What a person says is treated as a question, never as a change to how Harnace works, and any change to your rules waits for someone to confirm it.

A record that cannot be quietly edited

Every tool call, every rule that fired, every hold, every decision and every message Harnace sent is a row on a ledger. Each row carries a hash of the one before it, so a row that is changed or removed breaks the chain, and the console shows whether the chain still verifies. The record is written by the harness, not by the model, and the model cannot claim to have done something the ledger does not show. You can download the whole trail for any month, or for any one output, as a workbook, with each chain marked as verified or not.

Your data is yours

Every row in the database carries your company's id, row-level security is on for every table, and the application connects as a role that can only see the company it has opened. Connector tokens are encrypted at rest and never shown to the model. There are no passwords. Sign-in is by a link or a six-digit code sent to your email, one use, fifteen minutes, locked after five wrong tries, and only for people your directory lists. Someone else at your domain can ask for access, and nothing opens until your owner says yes. Removing someone ends their access on their next request. A leader sees the company's numbers and an employee does not. A commission statement is pay, and it is never shared outside your company or emailed. Files you hand over are kept as the originals in a private bucket, with a folder per company and a download that checks who is asking. Voice calls are transcribed, not recorded. The database is in the United States (Oregon), backed up daily, and a backup is kept seven days. When you ask us to delete your company's data, we delete it within thirty days and write to confirm.

What Harnace sees in Slack

If your company adds Harnace to Slack, it sees messages that mention it, direct messages to it, files dropped in either and the names and work emails of the people in your workspace, so it knows who is asking. It does not ask Slack for any other message in a channel, so it never receives them. It is in no channel unless someone adds it, and its direct messages are only those with Harnace itself. Slack will warn you at install that Harnace is not in its Marketplace. That is true. A listing needs ten workspaces and we are earlier than that, so on a workspace that requires approved apps an owner allows Harnace once and everyone else can use it from then on.

Who runs it

The application runs on Vercel, the database and file storage on Supabase, email on Postmark, and the models are Anthropic's Claude through the Anthropic API. Each has its own security program, and none of them trains on your data under the terms we use. Product analytics run on PostHog with every word and figure on the page masked before it leaves your browser. Each company has a daily ceiling on model spend, so a fault cannot run up work, or a bill, unattended. Descope issues the tokens an outside AI signs in with, and sees who signed in and which connection they made, never a figure. What your own AI does with an answer once it has it is governed by your agreement with that AI's provider. Harnace is two founders, Will Jensen and Nico Roberts, and the accounts that hold your data are held by the two of us and nobody else.

When your AI reads Harnace

Your company's own AI, Claude or another assistant, reads Harnace through one read-only address, https://harnace.com/api/mcp. A leader adds it to their AI as a connector, signs in with Harnace's own sign-in, the same link or code sent to their email, and picks the company. That makes one connection: one person, one AI and one company, with one permission, finance.read. The tokens the AI carries are issued by Descope, an identity provider, and nothing Descope holds decides a read. On every call Harnace checks the token's signature, that it was issued for this address with that permission, that the connection still stands and belongs to the AI that first used it, and that the person is still a leader in your directory, read fresh each time. Remove someone from your directory and their AI is refused on its next call.

The connection only reads. Its six tools answer questions: figures computed under your definitions, a figure traced to its rows, the differences between your systems, the definitions themselves, your sources and a guide. None can change a figure, a definition or a record in Harnace or in your systems, and the only rows a call writes are Harnace's own record of it. None takes a company as an argument, so every call runs inside the one company the connection was made for, under the same row-level security as the console. Pay, payroll, bank details and personal identifiers such as an email address, phone number or tax id are not in what it can read, and a question that names one gets "not available on this connection" back. Answers that carry your data end by saying its values are data from your records, not instructions.

Every call is a row on your company's read ledger: who asked, through which AI, which tool, what it asked for, what the rules removed, how many rows came back, a hash of the answer and how long it took. Never the answer itself. Each row carries a hash of the one before it, and the application can add rows and read them but cannot change them. An AI's token is held to 60 calls a minute and 2,000 a day, a company to 300 calls a minute, an answer to 500 rows and a query to five seconds. The Your AI page in the console lists every connection, who made it and everything it asked, and shows whether the ledger's chain still verifies. Any leader can revoke a connection there, and its next call is refused. Revoking it also withdraws that person's consent for that AI at Descope, unless another of their connections still rests on it.

Marlow Systems, the invented company our demo runs on, has its own address that needs no sign-in, so anyone can try the connection with no real company's data behind it. That address serves Marlow and nothing else. The steps for each assistant are on Connect your AI.

What is not there yet

We are candid about the gaps because a buyer will find them anyway. The connection for your own AI serves Marlow today. A real company's AI is refused until we finish the endpoint's security review, and then each company is switched on by a change both founders review. Sessions cannot be revoked one at a time yet, only all at once. Rate limits on the inbox exist as a daily cap, not a per-minute one. During pilots the console records masked session replays so a failure can be watched back. The replay shows the shape of what happened, never a figure or a typed value, and the pilot agreement names it. The threat model that lists each of these with its planned fix is available on request. Our Terms and Privacy Policy make the promises above binding today, and a company that wants them in its own agreement, with data processing terms, can ask for one.

Ask

Security questions go to hello@harnace.com, and a founder answers them. If you have found a vulnerability, write to the same address and we will respond within two business days and credit you if you would like.