Security and governance
Protection of client and family information, institutional continuity and hard-earned client trust depend on deliberate operating decisions.
Joans makes responsibilities and control mechanisms explicit so leaders have clarity and confidence when they approve technology change.
Information handling
Identify the authoritative source, sensitivity, permitted purpose, users, retention need and disposal path before information is copied or exposed to another capability. Use the smallest set of information required for the stated purpose.
As sensitivity increases, control, review and evidence increase.
A Public
Approved for public distribution.
B Operational
Routine firm operations without confidential content.
C Internal confidential
Restricted internal business information.
D Client-identifying
Information that identifies a client, family or related party.
E Client financial
Financial positions, plans, transactions and reporting.
F Client sensitive personal
Highly sensitive personal and family information.
G Privileged / regulatory
Privileged, examination, investigation or regulatory material.
A service, system, workflow or change inherits the highest information class it can touch.
The classification follows information through systems and files, provider access, integrations, automation and AI-assisted capabilities.
The model orders seven information classes from public material to privileged or regulatory material. Each step upward requires stronger control, review and evidence. A service, system, workflow or change takes the highest class of any information it can touch.
Establish the authoritative identity source, role and privilege model, approval path, service-account ownership, and joiner, mover and leaver controls. Access should reflect current responsibility and be reviewable without reconstructing it from individual systems.
Identify the authoritative source, sensitivity, permitted purpose, users, retention need and disposal path before information is copied or exposed to another capability. Use the smallest set of information required for the stated purpose.
Record where data is processed, how development and production are separated, which providers can gain access, and where each operating responsibility begins and ends. Contracted controls and technical configuration need to describe the same boundary.
Preserve a reviewable record appropriate to the decision: access and configuration changes, releases, approvals, material automated actions, exceptions and security-relevant events. Logs require an owner, a retention policy and a practical review path.
Define acceptance, security and recovery tests before release. Record who can approve production use, what would stop the release, how a prior state can be restored, and how restoration has been verified.
Name the incident authority, escalation route, provider contacts, recovery priorities and manual fallback for essential operations. Continuity depends on current records and rehearsed decisions as much as technology.
Specify approved information sources, permitted actions, review requirements, exception handling and the record to retain. AI assistance remains inside the institution’s authority model; qualified people approve professional judgments and consequential action.
Protection architecture
A control becomes useful when it is connected to the people, systems, information and providers that operate it. The boundary map makes those dependencies visible before production use.
Firm authority, records and access decisions remain inside this boundary.
Accepted results return to the correct firm record; working material follows its agreed retention or removal path.
Provider access boundary
Provider access reaches this boundary only after the same institution identity and access gate.
Agreed firm or provider environment
Operation stays inside the documented purpose, configuration, change and support boundary.
Authorized information begins in the institution record.
A named person or service receives least-necessary access.
Only the permitted purpose and information class cross.
Configuration, validation and support stay inside scope.
Accountable human approval accepts consequential use or release.
The approved result returns; working material follows its retention path.
Authoritative firm systems, the identity and access gate, and the record-return target remain inside the institution-controlled boundary. An approved provider interface and controlled capability remain inside the approved provider boundary. The approved path crosses from firm systems through identity and access, the provider interface and capability, then accountable approval returns the accepted result to the authoritative firm record.
A high-level description is enough to establish the matter. Client names, account information, credentials, investment documents and other sensitive material do not belong in the public contact path.
Before engagement work requires access, the institution and Joans agree which systems and information are needed, the permitted purpose, where work may occur, who may receive it and which retention requirements apply.
Access is assigned to named people or service identities, limited to what the work requires and removed when it is no longer needed. Shared credentials are not an acceptable access model.
The institution and its providers retain the authoritative systems and records. Engagement working material does not quietly become a replacement system of record.
Client or family material is not sent to an AI or model provider unless the institution has documented the permitted purpose, information, provider, controls, human review, retention and approval.
Return, removal or agreed retention of engagement material is established at close, together with access removal, the records the institution keeps and any unresolved exception.
Joans works on technology, operations, and implementation. Investment, legal, tax, compliance, and other professional judgments remain with the client and its appointed professionals.
Specialist providers remain responsible for the managed infrastructure and security services they are contracted to operate.
Architecture record
Joans records the operating context, authority, information sources, controls, provider responsibilities, test results and rollback conditions that support a technology decision.