How List Advisors handles your data
What we do
- Read-only, and only after you sign. You sign an authorization that names the systems, the access level (read-only) and the dates. Access ends on the last date.
- You run the collector. A signed, read-only tool runs under your sign-in. Your admin approves read-only permissions for the collection window; we remove them afterward and send proof. Prefer not to? We do it together over screen-share (Microsoft Teams; recordings are kept as evidence).
- Rules rate, people sign. A fixed rule set gives every rating. AI only drafts, every AI claim quotes its source, and our code checks the quote. Jason List, Principal, reviews and signs every Review and Assessment.
- Your data never trains AI. Our AI runs on Microsoft Azure with zero data retention. We keep a tokenized AI log for 2 years after the engagement.
- Free Check uses public data only. Kept 90 days. Opt out any time; opt-out covers your whole domain.
- Readiness, not certification. Our reports aren't a certification, an audit opinion or legal advice.
What we never do
Ask for passwords or admin rights · change settings in your systems · scan without written permission · sell or share your data for marketing · use your data to train AI · tell your carrier or auditor anything you didn't send them.
How long we keep it
| Data | How long we keep it |
|---|---|
| Free Check results | 90 days |
| Collected evidence (collector output, exports, screenshots, screen-share recordings) | 90 days after the report is delivered; annual check clients until the next cycle's report, max 13 months |
| Answers, findings, gap matrix, scores | While the account is open, plus 90 days |
| Signed reports, engagement letter, authorizations, evidence index (IDs and hashes, not files) | 7 years |
| Tokenized AI log (ours) | Engagement plus 2 years |
| AI requests at the model provider (Azure) | Not stored (zero data retention) |
| Access and audit logs | 1 year |
| Billing records | 7 years |
| Backups | 35 days, rolling |
| Website contact form messages | 90 days |
| Account deletion | Everything except the signed record and billing deleted after a 90-day grace period |
How the platform is secured
Second sign-in step required on every account · encrypted in transit and at rest, plus per-client encryption keys for evidence · uploads checked for malware and for customer data before we accept them · each firm's data kept separate, access logged · IT providers answer through expiring links and see only their questions · staff access limited to the principal today, from managed devices · no SOC 2 report yet; we'll answer your security questionnaire.
Who else is involved (subprocessors)
| Company | What for | What they see | Where |
|---|---|---|---|
| Microsoft Azure | Hosting, storage, email | All client data | United States |
| Microsoft Azure (AI models) | Drafts findings | Evidence excerpts during review; zero data retention | United States |
| Microsoft Teams | Screen-share sessions | What you show us | United States |
| Stripe | Card payments | Name, email, billing details | United States |
| Have I Been Pwned | Leaked-password lookups | Your verified domain only (the verification token is on our account) | Australia |
| Shodan | Internet exposure lookups | Your public IP addresses | United States |
We email account owners 30 days before adding a subprocessor.
If something happens on our side
We notify affected clients within 48–72 hours at most, and sooner where the law requires. We notify our own carrier and regulators as required.
Report a security problem
security@list-advisors.com · /.well-known/security.txt. We reply within two business days and won't take legal action over good-faith research that doesn't access client data or disrupt service.