How PBC Nudge handles client files
PBC Nudge collects the documents on an audit firm's PBC list from the firm's clients. This page says what happens to those files, who can see them and when they are deleted.
Storage and transport
- Files are stored in Cloudflare R2, which encrypts them at rest.
- Every page and upload is served over HTTPS only.
- Files are never attached to emails. Emails carry a link to the client's page, nothing else.
Client links
- Each client contact gets one link with 128 random bits in it, listing only the items assigned to them.
- The link is upload-only: it accepts files but never shows or returns files uploaded earlier, including the contact's own.
- The firm can replace a link at any time; the old one stops working at once.
- Links stop working 30 days after the firm closes the engagement, or at once if the firm's subscription ends.
Downloads and the access log
- Only the signed-in firm can download files, and every download goes through PBC Nudge, which checks the file belongs to that firm's account.
- Every download is written to a per-file access log the firm can read: who, when, and a one-way hash of the network address.
Retention and deletion
- Files are deleted from storage 30 days after the firm closes the engagement.
- An engagement with no activity for 180 days is closed automatically, after a warning email to the firm 7 days before.
- The firm can delete an engagement and all its files at once, at any time.
No AI on client files
PBC Nudge does not send client files to any AI model, and files are not used to train AI. The two checks it runs on uploads are plain code: whether the file is the format the firm asked for, and whether a spreadsheet looks like it holds Social Security numbers.
Not for participant-level 401(k) or census data
PBC Nudge is for nonprofit, HOA and private-company audits and reviews. A spreadsheet that looks like it contains Social Security numbers (three or more) is held: it is stored but cannot be downloaded until the firm reviews it, and the firm is emailed at once. A spreadsheet PBC Nudge cannot read is held the same way.
Certifications
PBC Nudge has no SOC 2 or ISO 27001 report. If your firm requires one from vendors, PBC Nudge is not the right tool for you yet.
PBC Nudge is run by PhoneScreen AI LLC. Security · Privacy · Terms · pbc-nudge@coinudge.com