Privacy policy
Last updated June 9, 2026
What this application stores
Cairn stores the data your firm puts into it: uploaded financial documents (tax returns, P&Ls, bank statements and similar), the structured data extracted from them, SDE worksheets and add-back decisions, firm branding, your per-user contact card, and the user and organization identifiers issued by the authentication provider. Nothing else is collected — there is no analytics tracking, advertising, or sale of data of any kind.
Third-party processing — read this part
Document content is sent to Anthropic's API to perform extraction; that is how the product reads a tax return. Requests are made server-side over TLS using your operator's API credentials. Authentication is processed by Clerk when enabled. Other processors receive data only when the feature that uses them is switched on: a teaser with voiceover sends its narration script, representative imagery sends a search term or an image prompt, and a subscribing workspace sends its firm name and advisor email for billing. None of them receive documents or deal figures. The exact list for this deployment is shown in Settings → Security and is derived from the running system's own configuration, not from this page.
Who can see your data
Every deal-scoped record is bound to your organization, and that boundary is enforced inside the database queries themselves — a request from another organization receives "not found", never your data and never confirmation the record exists. Within your organization, the firm chooses between open visibility (every member sees every deal) and private visibility (a deal is seen only by its owner and explicitly shared members).
Retention and deletion
Data persists until your firm deletes it. Deleting a deal removes its documents, extractions, worksheets, and add-back reviews; the stored file content itself is removed from disk as soon as no remaining document references it. Analytical records are append-only by design (revisions are kept for the audit trail) — deleting the parent deal removes the entire history.
Where it lives
cairncim.com is operated by Narrowpath Systems: the database and the document storage volume run on our hosting provider's infrastructure, not on your own servers. Documents are encrypted at rest, and the live status of that — including the cipher in use — is reported in Settings → Security straight from the running system. This policy makes no claim beyond what that panel reports. Firms that run their own installation operate that infrastructure themselves, and the same panel is the authority there too.
Questions: enterprise@narrowpathsystems.com · +1 (765) 697-8504 · Privacy · Security · Terms · Contact