Maxima defines customer data as any information ingested from, processed for, or generated on behalf of your financial systems. This includes general ledger transactions, journal entries, bank statements, reconciliation records, supporting documentation, and agent-prepared outputs. All such data is classified and handled as Customer Confidential under Maxima’s data classification policy.

Yes. Maxima’s SOC 2 Type II and SOC 1 Type II reports are available under NDA. Customers and prospective customers can request access through their Maxima representative or by contacting security@maxima.com.

Maxima processes and stores customer data in Google Cloud Platform data centers located in the United States. Customer data is not transferred or hosted outside the U.S.

Maxima maintains contractual agreements with providers including OpenAI, Anthropic, and Google that explicitly prohibit the training, fine-tuning, or retention of customer data. All model usage is limited to inference-only workflows and is configured for zero data retention.

Access to customer data is governed by zero-trust and least-privilege principles. Permissions are enforced through role-based and attribute-based access controls, with regular access reviews conducted by Maxima’s security team. When access is no longer required, including during employee offboarding, permissions are removed on a defined and controlled schedule.

Maxima is designed so agents prepare work while authorized accounting users remain in control of review, approval, and posting. Approval gates and segregation of duties are enforced within the product, and every action is captured in an immutable audit trail with clear source-to-output lineage.