YourHoursBack.ai
For compliance officers & due-diligence reviewers
Where your clients' data goes — and where it can't.
Every task in this product runs under one of five gates, from Gate A, where the system sees metadata only, to Gate E, where the capability doesn't exist. Not switched off. Never built. This page is the full framework — each gate's rationale, the mechanisms that enforce it, and every third party named — written to be read, printed, and audited.
- Gate A: Runs itself, never sees content.Live today
- Gate B: Drafts, you send.
- Gate C: Assembles, you or your CCO sign.
- Gate D: Assists, you decide.
- Gate E: Private and in control.
Each gate, and why it holds
Nothing here is collapsed or summarized — the same gate rationale the product shows advisors, in full.
Gate A: Runs itself, never sees content.
Inbox triage, firm ops, document filing.
The Gmail connection is scoped to gmail.modify — the narrowest scope Google offers that can apply a label to a thread — and everything Gate A work reads, it reads as metadata only: sender, subject, labels, and thread structure, never the message body. Across the whole platform, Gmail is written to in exactly three ways, and this is all of them: applying the single category label your rules computed — and swapping it for the right one when you correct a classification; creating drafts in your own Gmail Drafts folder, under Gate B; and moving emails to your own Gmail Trash, recoverable there for 30 days — which only ever happens when you select them and click Delete in Gmail yourself. Gate A work never opens, stores, or sends message content. A connector that runs entirely inside your own cloud project, so raw metadata never reaches our servers at all, is on our roadmap.
Gate B: Drafts, you send.
The agent has no send credential; the advisor's hand is the only path out.
The system holds no send credential, so nothing can leave your outbox on its own — a draft only becomes a message when you send it. Drafting does read: to write a reply in your voice, the system reads the full thread it's replying to — your client's messages included — along with examples from your own past Sent mail, and sends that content to Anthropic's Claude, the third-party AI model that composes the draft. The same is true when it assembles meeting notes and agendas. Read to draft, never to send.
Gate C: Assembles, you or your CCO sign.
Fee reviews, engagement agreements, ADV updates.
Assembling a document is drafting, not filing — signature and submission stay with you, or with your CCO if your firm has one. The system prepares; it does not sign.
Gate D: Assists, you decide.
Plan and portfolio work is software-assisted, human-decided — fiduciary duty is non-delegable.
Software assembles the analysis; the judgment call stays with the advisor. Fiduciary duty is non-delegable, so the system makes no decision for you.
Gate E: Private and in control.
Trades, money movement, and private information like SSNs stay entirely in your hands — the system has no capability to touch them.
These capabilities are not switched off — they do not exist; the system cannot send or trade, and it deletes nothing on its own: the only deletion anywhere is the one you trigger yourself with Delete in Gmail, and that goes to your own Gmail Trash. There is no token column in our database that could authorize a send or a trade.
Enforced by structure, not by promise
Positioning can change; the machinery doesn't. Each mechanism below exists in the shipped product, and where the product already discloses it to advisors, this page quotes that disclosure verbatim.
OAuth scopes, disclosed by name
Verbatim from the Gmail connect card advisors consent on:
Two scopes: gmail.modify — the same scope Google requires to read and label your mail — and calendar.events.readonly, added 2026-09-04 so Meeting Agendas can read a scheduled meeting's time and attendee. With gmail.modify we read metadata (sender, subject, labels, thread structure) for triage and classification; we read full message text only where a drafting or compliance activity needs it — the thread a reply is drafted against, and your own Sent mail for voice matching and compliance sampling; and we make exactly three kinds of writes: applying or swapping the one category label our rules compute, creating drafts in your own Gmail Drafts folder, and — only when you explicitly click Delete in Gmail on emails you selected — moving those emails to your own Gmail Trash. We use calendar.events.readonly only to read your calendar's event times and attendees — it cannot create, change, or delete anything on your calendar.
What can never happen — and why the list is short
Verbatim from the Gmail connect card advisors consent on:
A send path — we never send anything, and there is no credential in this system that could. Message content is read only where a specific activity needs it and its page says so: drafting reads the thread it's replying to — your client's messages included — and that content goes to one third party only, Anthropic's Claude, the AI model that composes your draft, then is discarded, not kept on our servers; Compliance Email Sampling reads and stores your own Sent mail, by design and only there. Triage and classification never read content at all. Nothing is ever deleted automatically: the only deletion that can happen is when you select emails and click Delete in Gmail yourself, and that moves them to your own Gmail Trash — recoverable there for 30 days, never permanently purged by us. And we never create, edit, or delete a calendar event — calendar.events.readonly can't do that even if we wanted it to.
No send path — draft and hold
The system holds no send credential. Every drafting activity writes to the advisor's own Gmail Drafts folder and stops — a draft becomes a message only when the advisor sends it. This is enforced as a static property of the source code: automated tests read every file in the drafting features and fail the build if a Gmail send endpoint ever appears in one.
Append-only audit ledger
Advisor actions are recorded in an audit ledger the application's database role can only read and append to — it holds no UPDATE or DELETE grant on that table, so recorded history cannot be rewritten by any code path, ours included. The ledger is isolated per firm by row-level security the database itself enforces.
Risk-phrase gate on outbound-facing work
Every marketing draft is checked against the firm's risk-phrase list before the advisor ever sees it, and nothing is ever posted anywhere by this system. Compliance Email Sampling checks a stratified daily sample of the firm's own Sent mail against the same list, queuing each email for a human signature — the signature is the compliance artifact.
Token custody
Verbatim from the Connect screen:
Encrypted at rest, isolated to your firm by row-level security. Never in plaintext, never shared across tenants.
Third parties, named
Every third party that touches content appears by name in the product at the point of use — not only on this page.
- Anthropic — Claude
- Drafting reads the full thread it's replying to — your clients' messages included — along with examples from the advisor's own Sent mail, and sends that content to Anthropic's Claude, the AI model that composes the draft. It is discarded after composing, not kept on our servers. Don's answers are composed by Claude from read-only lookups.
- Fish Audio
- Don's spoken audio is synthesized by Fish Audio from his reply text.
Verbatim from Don's chat panel:
Don can look things up — he can't send, write, or move anything. That's still all you. His answers are composed by Anthropic's Claude from what he looks up, and his voice is synthesized by Fish Audio from his reply text.
The rest of the product speaks for itself.
Every activity page states what it reads, what it writes, and what it can never do — in the same words this page uses. If a consent screen ever asks for more than its card describes, stop and tell us.