Workspaces and roles
Each firm has its own workspace. People in your firm see and do what their role allows.
Security and data protection
Your clients’ data. Your firm’s control.
See where Truecast stores client data, how access works and the commitments your firm receives under our Terms and Data Processing Agreement.
Key facts for your firm
EU data storage
Databases and file storage use Cloudflare’s EU jurisdiction, encrypted in transit and at rest. Encrypted offsite backups are held in Microsoft Azure in the EU.
Two client-data subprocessors
Cloudflare hosts Truecast. Microsoft Azure stores our encrypted offsite backups.
Access by firm and role
Each firm has its own workspace, with role-based access and an audit trail of changes.
Your choice of AI assistant
Truecast makes no AI calls and never trains AI on client data. Any assistant your firm connects works under your agreement with its provider.
Your team approves
An assistant can prepare drafts and scenarios. Someone in your firm reviews and confirms any change to a client’s plan.
Oversight rights in the contract
Our Terms and DPA give your firm and the FCA information and access rights.
Access and control
Your firm decides who uses Truecast and what they can do. Nothing an assistant prepares reaches a client’s plan until someone in your firm reviews and saves it.
Signing in
Microsoft 365, passkeys or one-time email links. Microsoft sign-in requests only openid, profile and email permissions, with no access to mail, files or calendars.
Credentials
Sign-in links, invitations and sessions are stored as hashes, not in readable form.
Your approval
An AI assistant can prepare drafts and scenarios. Changes to a client’s plan are confirmed by someone in your firm, in Truecast.
Audit trail
Changes to plans and settings are recorded.
Our support team
Our support console shows your workspace settings, users and sign-in records, not the content of client records. Our staff cannot sign in as one of your users.
Hosting and AI
Truecast runs on Cloudflare, with client data stored in Cloudflare’s EU jurisdiction. A daily encrypted backup is held in Microsoft Azure in the EU and locked against change or deletion for 35 days. If your firm connects an AI assistant, it works for you under your agreement with its provider. Truecast answers the requests it sends.
Your firm
Advisers and paraplanners
Signed in through the browser
- Encrypted (TLS)
Our subprocessor
Truecast on Cloudflare
Databases and file storage in the EU jurisdiction, encrypted at rest
- Requests from your assistant
Optional, under your contract
Your firm’s AI assistant
For example Microsoft 365 Copilot, under your agreement with its provider
| Subprocessor | What it does | Data stored in | Transfer safeguard |
|---|---|---|---|
| Cloudflare, Inc. | Hosting and logs, databases, file storage, network security and access control | EU jurisdiction | UK adequacy regulations for the EU, and Cloudflare’s Data Processing Addendum with the EU Standard Contractual Clauses and UK Addendum |
| Microsoft Limited | Microsoft Azure Storage for encrypted offsite backups of databases and stored projection results | EU: the Netherlands, with a copy in Ireland | UK adequacy regulations for the EU, and Microsoft’s Products and Services Data Protection Addendum |
Your contract
These commitments are in our Terms and Data Processing Agreement. Your firm agrees to both by signing an Order Form.
Breach notification
Without undue delay, and within 48 hours of our becoming aware of a personal data breach affecting personal data we process for your firm.
Subprocessor changes
30 days’ notice before we add or replace a subprocessor, with a right to object.
Oversight and access
Information and access rights for your firm and the FCA, to support your oversight of us as a supplier.
When you leave
Your firm chooses whether we return or delete its data. We confirm when live data is deleted, and again when the locked offsite backups are deleted, usually about 36 days later, as the DPA sets out.
Questions
If your due-diligence questionnaire asks something not covered here, send it to support@truecast.co.uk.
Can Truecast staff see client plans?
Not through our support console, which shows your workspace settings, users and sign-in records, not client records. Our staff access client data only when needed to run, secure or restore Truecast, to look into a problem you report, or where the law requires it.
What happens if we connect an AI assistant?
Your chosen assistant works for your firm under your agreement with its provider. It is not our subprocessor. Truecast answers the requests it sends, and someone in your firm confirms any change to a client’s plan.
Do you use client data to train AI?
No. Truecast makes no AI calls, and our Terms say we won’t use your data to train any AI model.
Do we need a separate DPA?
No. Our Data Processing Agreement is part of our Terms, which your firm agrees to by signing an Order Form.
What database recovery is available?
Cloudflare’s point-in-time recovery lets us restore Truecast’s databases to any moment in the previous 30 days. We also take a daily encrypted backup of the databases and stored projection results, held in Microsoft Azure in the EU (the Netherlands, with a copy in Ireland) and locked against change or deletion for 35 days.
Is Truecast regulated by the FCA?
No. Truecast is software and gives no advice. Our Terms support your firm’s oversight of us as a supplier.
What about certification?
Wealthcast Ltd is Cyber Essentials certified.
Contact
Who provides Truecast
Wealthcast Ltd, company number 17455947. Registered office: 128 City Road, London, United Kingdom, EC1V 2NX. ICO registration ZC253434.
Due diligence
Send your questionnaire to support@truecast.co.uk.
Report a security issue
Email support@truecast.co.uk with “Security” in the subject line.
Last reviewed
22 October 2026