How we work
You'll be sending us fund data, so here are the rules we work to and what each one means for you.
What happens to your files
- On arrival
Received and locked
Your files come through your own secure transfer link. Each one is fingerprinted and stored encrypted, under a key made for your case. Never a password, never a login to your systems.
Entry 806 fa41c036acfaed6d - During the check
Checked on fixed rules
Read, rebuilt and checked on one encrypted laptop. Not uploaded to a cloud service, not read by an AI model. The same files always give the same result.
Entry 807 34c64c86fecb890b - On the results call
Taken through every finding
A person goes through each finding with you before anything is changed. You decide what to correct.
- On the agreed date
Deleted, with a certificate
The key is destroyed, the computer is searched for stray copies, and your certificate cites the log entry that records it.
Entry 808 2b5b51625a1b8fb8
Entries from our sample case on a made-up fund. Each entry carries the hash of the one before, so changing any entry would break every entry after it. The log holds counts and file fingerprints, never your figures.
TryPipelineDeletion certificate
Ref DEL-SAMPLE-0023
Ref DEL-SAMPLE-0023
Deletion complete
Your files have been deleted
Ashcombe Capital LLP (invented, sample only) · deleted 26 October 2026, 11:25 UTC
Files you sent us
filed_return_2025.xml39379d065e1c…
source_pack.xlsx63f1d1a1d1eb…
What our software checked
The key that encrypted your files is destroyedYes
The case folder and working area are goneYes
No other copy on this computerNone found
Deleted by the agreed dateYes
Entry 808 in our audit log
2b5b51625a1b8fb8…UK GDPR and the Data Protection Act 2018UK data protection law
When you send us files, we act as your processor under a written data processing agreement. We sign it, with an NDA, before you send anything. Please send files through your own secure transfer, such as your data room or SharePoint, so they come straight into an encrypted case with a key made for it alone. They are deleted by the date we agree, 30 days unless you set another.
Data (Use and Access) Act 2025Changes to UK data law, in force in stages
We work to the law as amended, including the changes that took effect in 2026.
EU GDPRRegulation (EU) 2016/679
Applies when we work with EU managers. The same agreement and the same safeguards.
PECRSI 2003/2426, email and cookies
We only email people about their work, say where we found their name, and stop when asked. This website sets no cookies.
EU AI ActRegulation (EU) 2024/1689
The check runs on fixed rules. It doesn't use an AI model to make decisions about your return. We use AI tools to help write our software and research the rules, and we'll tell you where. Someone at your firm still reviews and files the return.
DORARegulation (EU) 2022/2554
EU managers must have certain terms in contracts with technology providers. We agree the terms Article 30 requires before any work starts.
FCA outsourcing rulesFCA Handbook SYSC 8
UK firms must manage outsourcing risk. We give you what your outsourcing file needs: our controls, the providers we use and an exit plan.
SEC Regulation S-P17 CFR Part 248, Subpart A
For US advisers: we protect any customer information you send us and tell you within 72 hours if it is ever exposed.
Legal Services Act 2007Reserved legal activities
We are not a law firm and we don't give legal advice. We show which rule a value failed and where the value came from. The judgement and the filing stay with you.
Sending data across borders
Which rules let data move between the UK, the EU and the US, and how we use them.
EU adequacy decision for the UKImplementing Decision (EU) 2025/2574
Renewed in December 2025, to December 2031. EU clients can send data to us in the UK without extra contracts.
UK–US data bridgeSI 2023/1028
Lets UK data go to US companies certified under the Data Privacy Framework. We check a US provider's certification before relying on it.
EU–US Data Privacy FrameworkImplementing Decision (EU) 2023/1795
Upheld by the EU General Court in September 2025; an appeal is pending. If it falls, we rely on the clauses below.
UK IDTA and AddendumInformation Commission
The UK's standard transfer clauses, used where no adequacy decision applies.
EU Standard Contractual ClausesImplementing Decision (EU) 2021/914
The EU's standard transfer clauses, used for EU data where no adequacy decision applies.
Our documents
Privacy notice
How we handle personal data.
Filing Health Check
What the check covers, what we need and what it costs, on one page.
DownloadPDF
Sample Health Check report
A full report on a made-up fund with eight mistakes slipped in, so you can see what you'd get.
DownloadPDF
Sample free check
The report you get when you send only your filed return: what fails, what to confirm, what passed, and what a check of the return alone can't see.
DownloadPDF
Deletion certificate
Sent to you when we delete your files. It shows each file's fingerprint, that the key protecting them was destroyed, and the audit log entry that records it.
See a samplePDF
How to send files
Through your own secure transfer link, such as your data room or SharePoint. Excel workbooks or CSV exports. We never ask for passwords, and a password-protected file is sent back unopened.
NDA and data processing agreement
Signed before you send any files. Sent on request.
Last checked 1 October 2026. Questions about any of this: founders@trypipeline.io.