Designed so the record can be trusted.
A fiduciary record is evidence. The guarantees below are properties of how Truman is built, enforced by the database and the permission model rather than by policy.
One tenant, one boundary
Every entity, person and document belongs to exactly one organization, and no query crosses that line. An entity outside your organization is reported as not found, never as forbidden, so even the existence of another tenant's records is not confirmed.
Least privilege by default
A role grants exactly what the office carries: a bookkeeper drafts classifications and cannot approve a distribution; a CPA adopts tax positions without trustee powers; a beneficiary sees only their own. Overrides record who, when, what changed and why.
History is never rewritten
The ledger is append-only and hash-chained at the database level. A correction is a new entry naming what it corrects. Every statement is read from the events beneath it and can be reproduced at any point in time.
Evidence kept as filed
Documents live in versioned object storage. A document marked final cannot be replaced under its own name; a new version sits beside it with the old one intact.
Models propose; people decide
Any model in Truman holds a role that can propose a classification, explain a result and raise a review item, and nothing more. It cannot post, approve, verify a provision, close a period or compute a balance. Every proposal carries its model and reasoning, and acceptance is a human act.
Money handled by Stripe
Cards, invoices and receipts are on Stripe's hosted pages. Truman stores a customer reference and a subscription status, and never a card number.
In transit, and at the door
Every connection is encrypted with TLS. Passwords are hashed with bcrypt and must be at least twelve characters. Sign-in attempts are rate limited. A password an administrator sets must be changed before the account can do anything else.
The structure as of any date
Ownership interests, valuations and appointments carry effective dates and are never overwritten. The plan can be shown as it stood on any day, which is what a court, an auditor or a successor trustee asks for.
Your data is yours
Everything an organization holds can be read and exported by its administrators at any time, in good standing or not. Nothing is held hostage to a subscription.
Found a vulnerability? See how to report it. Independent assurance (SOC 2) is planned. If your firm needs a security questionnaire answered, write to us.