Trust, Security & Compliance

1. Trust & Security Overview

RetirementNeuron is a household-aware retirement planning platform. We combine deterministic, year-versioned planning logic with AI-assisted explanations. Protecting customer data and operating transparently are core product requirements—not afterthoughts.

• We design for least-privilege access, encrypted transport, and auditability of sensitive actions.
• We separate deterministic planning outputs from AI-generated narrative so customers can see what is rule-based versus explanatory.
• We maintain internal compliance-readiness documentation and controls; public summaries on this page intentionally exclude internal audit evidence.

2. Security Controls

Our security program includes technical and organizational measures appropriate for a SaaS retirement planning product. Specific implementations may vary by environment (local development versus staging versus production).

We do not publish penetration-test reports, unpublished vulnerability information, or internal architecture diagrams on this page. Responsible disclosure reports should be sent to our security contact below.

3. Privacy & Data Rights

Our Privacy Policy describes what we collect, why we use it, and how we share it. In addition, signed-in customers may request access, correction, deletion, and portability through in-product privacy workflows where available, subject to legal and recordkeeping exceptions.

• Access / portability: export of account-associated data in a machine-readable format, with sensitive fields redacted where appropriate.
• Correction: update profile and household information in settings, or submit a correction request for review.
• Deletion: account deletion or anonymization requests honored where permitted; some records may be retained for security, fraud prevention, billing, or legal obligations.
• Opt-out of sale/share: we do not sell personal information. California residents and browsers sending Sec-GPC: 1 are honored for applicable opt-out signals.

4. California Privacy Rights (CCPA / CPRA)

California residents may have rights to know, access, correct, delete, and limit use of personal information, and to opt out of certain sharing. RetirementNeuron supports privacy-readiness workflows aligned with these expectations, including:

• A description of categories collected and purposes of use in our Privacy Policy.
• Mechanisms to submit privacy requests (see Privacy Contact).
• Recognition of Global Privacy Control (GPC) signals where technically implemented.
• Non-discrimination for exercising privacy rights.

We are not claiming CCPA/CPRA certification. Response timelines and verification steps follow applicable law and our internal procedures.

5. GDPR Rights

Where the EU/UK General Data Protection Regulation applies, individuals may have rights of access, rectification, erasure, restriction, portability, and objection, plus rights related to automated decision-making. RetirementNeuron maintains privacy-readiness workflows to address these requests when they apply—not a claim of GDPR certification.

Lawful bases, international transfers, and retention are described at a high level in our Privacy Policy. Submit requests via the Privacy Contact; we may need to verify identity before fulfilling them.

6. AI and Retirement Planning Disclosure

The AI Strategist and related features use large language models to help explain planning concepts, reconcile inputs, and suggest next steps. Authoritative tax, Social Security, Medicare, RMD, and scenario calculations rely on deterministic engines and versioned rules—not on model guesses alone.

• AI outputs are educational and explanatory unless separately reviewed by a qualified licensed professional.
• Customers should verify material decisions with a CPA, attorney, or licensed financial professional.
• We log AI interactions with redaction; raw prompts are not retained indefinitely in production configurations.
• Tool use and entitlements are constrained so models cannot perform unauthorized actions on your behalf.

RetirementNeuron in ChatGPT

RetirementNeuron's ChatGPT integration provides access to supported retirement-planning tools through a conversational interface. Rule-based planning calculations are produced by RetirementNeuron's planning system, while ChatGPT can help explain supported results and explore authorized planning questions.

• Deterministic calculations come from RetirementNeuron. ChatGPT explanations are interpretive and can be incomplete.
• Results depend on the household inputs you saved and the policy-year rules used for that calculation.
• Connecting the plugin requires you to sign in and approve access. The published scope is retirement:read.
• The connection is read-only. A what-if answer in ChatGPT is not a saved scenario and does not change accounts, balances, or plans.
• When you ask a question, the information needed for that answer is processed in the ChatGPT session. OpenAI's terms apply to that conversation.
• An explanation is educational. It is not licensed financial, tax, legal, or Medicare advice, and OpenAI does not certify the financial accuracy of RetirementNeuron's calculations.
• Projections are not guarantees. Missing inputs should be treated as missing.

7. Compliance Readiness

RetirementNeuron invests in readiness activities that support trustworthy operations. The following describe our posture in plain language—without implying completed third-party audits unless separately contracted and verified:

• SOC 2 Type II readiness: control design and evidence collection aligned with Trust Services Criteria; an independent SOC 2 Type II report requires a formal observation-period audit by a CPA firm.
• Privacy-readiness workflows: consumer privacy request handling, classification, and retention policies maintained internally.
• Adviser-oriented recordkeeping controls: scaffolding for recommendation and disclosure records suitable for firms subject to SEC/FINRA recordkeeping—not SEC/FINRA approval of RetirementNeuron as a product.

We do not claim formal third-party SOC 2, SEC, FINRA, or GDPR certification on this page—only readiness and control activities described above.

8. Data Retention

We retain information for as long as needed to provide the Services, meet legal obligations, resolve disputes, and enforce agreements. Typical categories:

Deletion requests may be delayed or limited where law, fraud prevention, or adviser recordkeeping requires retention. See our Privacy Policy for more detail.

9. Subprocessors

We use reputable service providers to operate the platform. Categories may include:

A detailed vendor register, data-processing agreements, and vendor risk assessments are available under NDA or verified business purpose—see Request Compliance Documents.

10. Security Contact

Report suspected vulnerabilities, account compromise, or security incidents to:

Email: security@retirementneuron.ai

Please include steps to reproduce, affected URLs, and your contact information. Do not include live passwords or full payment card numbers in email.

General product questions belong on our Contact page.

11. Privacy Contact

Privacy requests and questions about this page or our Privacy Policy:

Email: privacy@retirementneuron.ai

Signed-in users should also use in-product privacy tools when available. Allow reasonable time for identity verification and fulfillment.

12. Request Compliance Documents

Enterprise customers, advisers, and procurement teams may request additional materials such as a high-level security overview, subprocessor list, or SOC 2 readiness summary. These materials are not posted publicly.

• Requests may require a mutual NDA or verified business purpose.
• We do not distribute raw audit reports, third-party penetration assessments, unpublished vulnerability information, or legal opinions through this channel.
• Turnaround depends on request scope and legal review.

Submit requests via our Contact form with topic "Sales / partnerships" or email privacy@retirementneuron.ai with subject line "Compliance document request."