Your data

Your data stays yours.

Cecchin only earns its place if you can trust it with the most personal numbers you have. Here is exactly how that works — in plain language, no asterisks.

🔒

Encrypted, and only yours

Everything you store is encrypted at rest and reachable only by your own login. Every record is keyed to you alone — no shared tables, no one else's account can touch it.

How: AWS-managed KMS encryption; per-account isolation enforced by your verified sign-in, not by good behaviour.
✅

You consent first

Nothing is saved until you agree to how your data is handled. That agreement is a real gate — not a checkbox that changes nothing.

How: writes are refused in the code itself until your consent is on record.
📤

Export or delete, anytime

Take everything with you as a file, or erase all of it — instantly, yourself, right in the app. No email, no waiting on support, no dark patterns.

How: one-tap export and one-tap delete on your account page, always available.
🧠

Your numbers stay on one AI — unless you start a voice call

When Cecchin answers you in writing, it uses Anthropic's Claude — and only Anthropic. The request travels either through Amazon Bedrock inside our own AWS account, or directly to Anthropic's API; both are Anthropic. Your data is never sold and never used to train anyone's model. That is true of every brief, every analysis, every typed answer.

Voice is the exception, and we would rather say so plainly than bury it. A spoken conversation runs on a realtime voice model from another provider — OpenAI, xAI or Google — because Anthropic does not offer a realtime speech model today. During a call, your voice and the figures needed to answer you are sent to that provider. It is entirely opt-in: there is no always-on microphone, you start every call yourself with a tap, and nothing is recorded or kept by us. If you never start a call, your figures never leave Anthropic.

Two other features can involve those providers, and neither one sends your figures. Compare models is a button you tap: it sends that one question you typed — not your stored data — to each of them so you can see who answers best. And when one of your agents proposes a change to its own instructions, the proposed wording goes out for a second opinion. Your accounts, balances and transactions never do.

How: in writing, your figures go only to Anthropic. In a voice call — which only you can start — they go to the voice provider for the length of that call. Compare-models and agent-wording are text-only and never carry your stored data. Property-value estimates come from RentCast, a data service (not an AI): it receives the property address you typed and, if you fill them in, what the building is — type, bedrooms, bathrooms, square feet — because that is what lets it find comparable properties. Only when you ask for an estimate, and never your figures, your accounts, or the rest of your property record (what you paid, your insurer, your notes), which stays with us. Address completion is the one place something is sent as you type: to offer suggestions after the first few characters, the partial address you are typing goes to Amazon Location Service — part of the same AWS account that already runs Cecchin, so no new company is involved. Only that address text is sent, in the one box where you type an address, and it is not an AI and receives nothing else.
🛑

It never moves your money

Cecchin is a judgment layer, not a bank. It reads, analyzes, and recommends — it never transfers, pays, trades, or places an order. The decisions stay yours.

How: read-only by design; there is no money-moving capability in the product to misuse.
✉️

It never sends an email

Connect Gmail and Cecchin can read what is waiting and write you a reply to a message you open. It cannot send one. The draft is yours to edit, and saving it puts it in your Gmail drafts — the send button is in Gmail, under your own thumb. Anything written in an email is treated as data to answer, never as an instruction to follow.

How: there is no send capability in the software at all — not a switch that is off, a capability that was never built. Deleting is nearly as narrow: your tasks and your own labels are yours to manage, so Cecchin can add a task, edit its title, notes, date or completion, and delete the one task you tap Delete on and then confirm — and it can delete a contact group you tap Delete on and confirm, which removes the label only, leaving every person in it in your contacts. Those two are the only deletes in the software. Calendar events and email drafts it can only create; it never edits or deletes an event or a message. Contacts you can create and edit from the app — a form you fill in and save; Cecchin never deletes a contact, and never changes one on its own. A copy of your contact list is kept in your account so the app opens instantly rather than re-reading your whole address book every time — encrypted, yours to export or delete, and removed when you disconnect Google.
✂️

We keep the minimum

Cecchin works from the finished numbers — your freedom date, your reserve, your spend trend — not from dumps of every raw transaction. Less stored is less at risk.

How: derived, summary figures wherever possible; we don't hoard what we don't need.

Trust, then depth.

This is the foundation. Everything Cecchin does for you is built on top of it.

Join the early access Try the demo

Questions about any of this? hello@cecchin.co. The full details are in our Privacy Policy and Terms.