What the Documents Say

A recurring review of what AI vendors serving wealth management actually commit to in their public documents: privacy policies, terms of service, data processing agreements, and security pages. Each edition takes one clause that matters to an advisory firm's obligations, reads it across the vendors that publish enough to assess, and records what was found by document and section. The reviews are the source for the ValaisOS registers. Written for compliance officers doing vendor diligence and for principals who want to know what they signed.

Start with the first and read forward.

If Your AI Vendor Is Breached, You Have Thirty Days to Tell Your ClientsIf my AI vendor is breached, what have they actually promised me, and where is that promise written down?

Nine Questions to Send Any AI Vendor Before You SignWhat should I actually ask an AI vendor before I let it near client information?

Planned editions: The vendors behind your vendor (subprocessors and model providers); Training clauses; Export and termination rights; Liability caps.

Fiduciary data custody

Fiduciary data custody is the principle that an advisory firm holds client information, decision reasoning, and supporting documents as entrusted property, received with a record of what arrived, held under the firm's own control, versioned so changes are attributable, and returned or produced intact on request. Under fiduciary data custody, the firm, not any software intermediary, is the accountable steward of what it knows about a client.

How to use a review

Read the edition, then send its questions to your own vendors in writing. Each edition ends with what a usable answer looks like, and the register that follows it records what each vendor's public documents say so the answer can be compared. File the replies with the contract; under Rule 204-2(a)(25)(v) any agreement made under Regulation S-P's service-provider provision is a required record in its own right.

Corrections

Every review is dated and every finding names its document. A vendor that believes an entry is wrong can send the document and section to hello@valaisos.com; corrections are recorded with the date in the relevant register's change log and entries are corrected rather than removed.

Questions

How are vendors chosen for a review?

Each edition starts from the same roster of companies selling AI into US wealth management and its advisers, and includes every vendor that publishes enough on the clause under review to assess. Vendors are never added or removed to change a count.

Why record the document and section?

Because a reader should be able to check any finding in minutes. Naming the document also shows where a promise lives, which is often not the privacy policy a buyer reads first.

What does "we could not find" mean?

That the provision was not found in the public documents read on the reviewed date. It is a statement about the search, not about the vendor, which may hold terms under non-disclosure or in negotiated agreements.