In an AI platform built for a financial firm, the AI should see what the person asking can see, and no more. In Super Chain, access is set on folders for a user, group or role, and sub-folders inherit it. A document someone cannot read is not listed, not searched and not given to the AI.
The same people who could see the document without AI. The AI is one more way to read the firm’s files, so it should carry the asker’s permissions, not its own.
In Super Chain, permissions sit on folders. For each folder, a user, a group or a role can be given read only, read and write, or no access. Download is a separate right.
When rules overlap, the most specific one wins. A rule for the person beats a rule for their group. Within groups, a block beats an allow. A role rule applies last. Once a folder has rules, anyone they do not name has no access.
Firm administrators keep access to everything, so someone is always able to answer for the files.
Check permissions before the AI reads anything, not after it answers. If the AI can read a file, it can quote it. So the search itself has to be limited to what the asker may open.
In Super Chain, the AI’s document search only covers documents the person asking can read. If the permission check cannot be completed, the search returns nothing rather than everything. Permissions are checked on every question, so removing someone’s access applies to their next search.
| Name | Type | Status | Uploaded |
|---|---|---|---|
| Term sheet v3.pdf | Term sheet | Approved | 2 Nov |
| Cap table 2026-10.xlsx | XLSX | Approved | 31 Oct |
| LPA side letter.pdf | Agreement | Approved | 28 Oct |
| Northbank credit facility.pdf | Loan agreement | Approved | 27 Oct |
| Monaco apartment deed.pdf | Title deed | Approved | 19 Oct |
| Office lease renewal.pdf | Lease | Pending review | 4 Nov |
Hyperion Series C: USD 4.0m at a USD 180m pre-money, 1x non-participating preference 1. Pro-rata on the next round 2.
I found nothing on a Northbank facility in the documents you can read.
Yes, when the folder rules are the same rules the search uses. In Super Chain there is one set of rules for the document list, for opening a file and for the AI.
A rule set on a folder flows down to every sub-folder below it, until a sub-folder has rules of its own. When someone first shares a sub-folder, it starts from a copy of the rules it inherited, so sharing adds people and does not quietly remove anyone.
No read access means the document does not exist for that person. It is not listed, not found by search and not given to the AI. Read and write on a folder lets someone manage that folder and what sits below it, but nothing above or beside it, and they can only share rights they hold themselves.
The same idea applies to work that is not a folder: each person gets a level, and the AI acts at that level.
With a record kept by the firm. In Super Chain every tool the AI calls passes through one permission check, and each call is written to an activity log with the user, the conversation and the result, including refusals.
A platform superadmin can view the product as a named user to check what they can see. That view is read-only, lasts at most 30 minutes, and is recorded in the audit log under the superadmin’s own name.
Regulators ask for this kind of control in general terms. In Hong Kong, Data Protection Principle 4 of the PDPO requires practicable steps to protect personal data against unauthorised access, and the SFC’s generative AI circular names the risk of confidential information leaking.
In the UK, Article 32 of the UK GDPR asks for security suited to the risk, including against unauthorised access. In the US, Regulation S-P requires written policies that protect customer information from unauthorised access or use.
Super Chain is a private AI platform for investment and wealth firms, family offices and brokers. Its permissions, review rules and audit log are part of the platform, not an add-on. The firm still decides who should see what; we set it up with the firm’s owner during the pilot. The trust and security page sets out the architecture, and five controls for using AI safely sets out the order of decisions.
This guide is for COOs, compliance officers and principals at investment and wealth firms, family offices and brokers who want staff to use AI on client files without widening who can see them.
It is not a full access-review programme. Joiner and leaver processes, device security and email controls sit outside it, and the firm needs those whether or not it uses AI.
Super Chain is accountable for the platform and its configuration. The office remains accountable for which documents go in, who may see them, and the terms of the model provider it chooses.
Super Chain is built by Super Cat Technology. The same team built a fully on-premise retrieval system for a Big 4 firm, where every answer returns with its source paragraph.
Whoever the firm’s rules allow, and the AI follows the same rules. In Super Chain, an administrator, or someone who manages a folder, gives a user, group or role read, write or no access. Sub-folders inherit the rule. When someone asks a question, the AI only searches the documents that person can read.
Make the AI search as the person asking. In Super Chain the document search only covers what the asker can read, and it returns nothing if the permission check cannot be completed. Documents waiting for review and private chat uploads are kept out of other people’s answers.
Yes, if permissions are checked inside the search rather than after the answer. In Super Chain a folder rule flows down to every sub-folder. A document someone has no read access to is not listed, not found by search and not given to the AI, so it cannot be quoted to them.
Yes. A platform superadmin can view the product as a named user to check their access. The view is read-only: it cannot change, download or export anything. It lasts at most 30 minutes, and the start, each request and the end are written to the audit log under the superadmin’s own name.
Every tool the AI calls goes through one permission check, and each call is written to an activity log with the user, the conversation and the result, including calls that were refused. The firm can read that log to answer who asked what, and which documents the answer drew on.
A 30-minute call with our team. We look at where your firm uses AI today, which documents and systems it would touch, and where it should run. You leave with a plan: what to start with, what to keep out, and which deployment fits. It is free.
Choose a time below. If you would rather see the platform first, book a private demonstration.