Last updated 2026-09-16.
This is a plain-English description of what this site does with what you give it. It is not written to protect the operator from you. Where something is a limitation rather than a promise, it says so.
Nothing you upload. Statement files are held in memory for the length of one request. The size cap exists so a very large file cannot exhaust the server, not so it can be kept. One exception, on a local install only: a PDF statement is written to a private temporary folder for the seconds the text extractor needs it, then deleted; the hosted copy does not parse PDFs.
One cookie, named aletheus_session — and only when this software is hosted for more
than one person (ALETHEUS_MULTIUSER=1). Run on your own machine, which is the default, it
issues no cookie at all. It is a random string. It is not an identity, is
never logged, never leaves this server, and is forgotten when the server restarts. Its only job
is to keep one visitor's searches out of another visitor's results. It is HttpOnly (scripts
cannot read it) and SameSite=Strict (another website cannot cause a request that carries it).
Two surfaces never take part in this at all, in either mode: the plain-English question box at
/ask and the anonymous read surface described below. Neither issues a cookie, neither reads
one, and neither is entered into any session — they answer from the roster archive alone and
gain nothing from knowing who is asking.
Six caches keyed by the thing you searched for — court dockets, individual adviser records, state actions, broker-dealer net-capital reads, fund-term timelines and learned fund identities. These are scoped to your session, stored outside the program's own directory, and deleted when your session goes quiet for 30 minutes or when the server stops. Another visitor cannot read them.
Caches keyed by public products — fund tickers, fund terms, the SEC's own enforcement index, published fee datasets. These are shared between visitors and are not deleted, because a cached fund ticker says nothing about any person.
Evidence bundles you build are written to disk on the machine running this software, and served only to that machine. If you are running this yourself, that machine is yours.
This software also carries a read-only surface for machine callers over the SEC roster archive —
the same four questions the site's own /ask page answers, returned as data rather than a page.
It is off unless a host both records a dated decision to open it and starts the program with
ALETHEUS_PUBLIC=1; without either, every request to it is refused.
When a host does open it, it has no account, no key, no cookie, and no per-caller counter. It keeps no record of what was searched — which is stated plainly as a limit rather than worked around: with no idea who is calling, it also cannot investigate a caller after the fact. It writes nothing anywhere, it answers read-only, and it never serves the two Form ADV disclosure columns, at any answer size, on any route.
When you ask about a firm, a person, or a fund, this software makes read-only requests to public sources — the SEC's EDGAR system and its adviser and enforcement records, the CFTC's enforcement listing and RED list, GLEIF's legal-entity register, and CourtListener (a Free Law Project service) — carrying only the identifier you asked about. The Department of Labor's Form 5500 index is read as a fixed page; your identifier is never sent to it.
It never transmits your uploaded statements, and never transmits a value that does not look like a stock ticker. Anything else in a Symbol column — an account number, a name — is held back and reported to you as unlooked-up.
The helper under a report. A question typed into the report page's helper goes to this server together with that report's own rows — public records the server had just served — and is answered from the site's glossary, its source catalogue and those rows; nothing about the question is kept. If the host has switched on the model fallback — it is off unless the host has configured a key, and off whenever the program runs offline — a question the glossary cannot answer is sent, with those rows, to Anthropic's API (api.anthropic.com) and to nowhere else, and the answer comes back labelled "from the model". Trade records, the draft demand letter, and anything placed in the upload step are never sent to the model or to anyone: the server rebuilds the report digest field by field before any model sees it, and those fields are not among them. The page says which mode it is in.
Setting ALETHEUS_OFFLINE=1 before starting the program stops every outbound request,
including during a refresh.
The SEC publishes its EDGAR access logs as a public dataset, including the requesting IP address with only the final segment obscured. Searching EDGAR yourself puts your own address in that published file. Searching through this software puts this server's address there instead — which is a reason it must not keep a record of who asked, since that would rebuild the same log somewhere with fewer protections.
This is not legal advice, and its author is not a lawyer. Everything here describes public records, or the documented absence of public records. It reaches no conclusion about any person or firm, and nothing it produces establishes wrongdoing by anyone.
This is not a consumer report. Its output may not be used to decide anyone's eligibility for credit, insurance, employment, housing, or any other purpose under 15 U.S.C. § 1681b.
A "not found" is never proof of a clean record. It means the sources searched, on the date searched, held nothing matching. Records can be expunged, sealed, or simply never filed. Every such result on this site carries its own date and the coverage limits of the source it came from.
Automated analysis may be inaccurate or incomplete. This software computes its figures from the files supplied and the records retrieved, and either can be misread — a mislabeled column, an unusual export, a source that changed its format. Verify every figure against the original records before relying on it.
This software retrieves records published by government bodies and non-profits. Their terms govern that data regardless of anything on this page.
On this hosted copy, nothing is ever retrieved from BrokerCheck or any other FINRA site — not by a visitor's request, not through the MCP surface, not by following a redirect. The site builds the link to the BrokerCheck page for a firm or an individual and the human opens it. Any field named "brokercheck" in hosted output is always empty, including from any cache.
On a local install — the tool running on your own machine — the person using it may ask for one individual's BrokerCheck record and the tool will fetch that one record, under the investor-protection provision of FINRA's Terms of Use, which permits copying and compiling BrokerCheck data for investor-protection, academic, compliance, or regulatory purposes. Those terms attach five conditions once the data reaches a third party, and the local install meets them as follows:
1. BrokerCheck is named as the source of any BrokerCheck data shown.
2. Links to BrokerCheck and to its Terms of Use accompany the data, with a notice that its
use is subject to those Terms.3. How the data is used is stated, and any change to it is described. This software presents
record fields as filed and does not rate, rank, or score any broker or firm. Where a label is this software's own reading rather than the record's words, it says so beside the label.4. Errors can be reported. If something shown here is wrong: where this software produced
the error, it will be corrected; where BrokerCheck is the source of the error, report it to FINRA, which is the only body that can amend the record.5. The retrieval date is shown with the data, and the software re-queries rather than
serving an expunged record from an old cache.No automated process — no scheduler, no bulk job, no AI-driven path — ever calls BrokerCheck on either install. FINRA's own Terms of Use: https://www.finra.org/brokercheck-terms-of-use
Each source's terms were read and captured before it was used, and each one's posture — what may be fetched automatically, what may only be opened by hand — is shown in the source table on the counsel page. Sources whose terms prohibit automated access are never fetched; they appear as labelled links for you to open yourself.
Court data comes from CourtListener, a Free Law Project service. Free Law Project neither produced nor endorsed any characterisation of it made here.
This software is designed to run on your own machine, where none of the above involves anyone
else. When run that way it binds to 127.0.0.1, which means no other computer — not even
another on your network — can reach it.
If you host it for others, you become responsible for what that server holds. The session
isolation described above is what keeps visitors separate, and it is off by default — start
the program with ALETHEUS_MULTIUSER=1 to turn it on.
Off is the right default rather than a careless one. On one machine there is no second visitor to be separated from, and scoping there would throw that user's own cache away every thirty minutes — each discarded answer becoming another request against an allowance a non-profit gives away for free. Isolation that costs the only user their cache, to protect them from themselves, is a worse tool. Hosting for other people means switching it on.
Both behaviours are covered by tests (test_sessioncache.py, test_server_session.py).
This document is versioned in the same repository as the software, so any change to these terms is recorded in the commit that made it.