Dossiers are not designed to provide personal contact information and do not support direct marketing approaches. DossierX is intended to facilitate relational access or referral-driven marketing strategies. These guidelines tell clients how DossierX handles personal data and what we ask of you in return.
1. Purpose and Scope
DossierX aggregates SEC filings, news, registries, social signals and other public records into living dossiers, relationship maps and alerts. Dossiers are built from sourced research and show the sources they draw on.
The guidelines apply to:
- Dossier data — information about the individuals and entities you research (the data subjects).
- Client workspace data — your watchlists, notes, queries, imported contacts and account details.
- Delivery channels — the DossierX web application and any connector (MCP) that feeds DossierX data into an AI assistant your organisation runs.
They sit alongside the DossierX Privacy Policy and Terms of Service. Where they differ, your signed agreement and data processing addendum govern.
2. Our Commitments
DossierX makes eight commitments on personal data. This is how each works in the product today.
| Commitment | What it means in practice |
|---|---|
| Your intelligence is yours | Access controls keep your notes, watchlists, imported contacts and questions from other clients, unless you share a watchlist with them. Your notes are visible only to you. |
| Nothing resold, nothing trained on | DossierX never sells what you look at or shares it with other clients, and never uses your data to train AI models. Service providers that run parts of DossierX, such as AI model providers, process it only to provide the service. |
| Shared research, private work | Dossiers are shared research: what the details and documents you supply establish about a person can become part of their dossier, which other clients can also read. The files you attach are not shown to other clients. Your notes, imported contacts and questions stay private to your organisation, and watchlists unless you share them. |
| Evidence first | Dossiers show the sources they draw on. Many findings link to their own source; others are sourced at the level of the section, and some summary fields from data providers, such as rankings and estimated net worth, are attributed to the provider rather than cited line by line. |
| Human oversight of AI | AI accelerates research. A dossier is published only once the subject's identity is confirmed, and its sources are shown so you can check it. DossierX makes no solely automated decisions with legal or similarly significant effects. |
| Public and lawful sources only | Dossiers draw on public filings, registries, reputable media and the subject's own public statements, plus any documents you attach to a request. |
| Thorough, within limits | Dossiers are thorough: they cover what published sources report about a subject, within the source rules in section 3 and the limits in section 5. |
| Deletion on request | You can delete your own notes, watchlists, alert rules and imported contacts at any time. Dossiers and other data are deleted on request, except where the law requires a record to be kept. |
3. What Data We Process, and From Where
DossierX processes three categories of data. Dossier data concerns the people you research, usually outside your organisation; the contacts you import may concern anyone you work with.
| Category | Examples | Source |
|---|---|---|
| Dossier data | Name, age, gender and citizenship; professional contact channels; employment and board history; investment history; family and professional affiliations; political contributions and affiliation; disclosed holdings, transactions and wealth estimates; philanthropy; reputational background; litigation involvement; public statements | Publicly accessible sources (below), and documents you attach to a dossier request |
| Client workspace data | Watchlists, notes, saved queries, alert settings, imported contacts (name, email, phone, employer, title, profile URL) | You, or an account you connect with consent |
| Account and usage data | User names, emails, organisation, authentication, logs and diagnostics | You and your sign-in provider; logs and diagnostics are generated by use of the service |
How we collect it
DossierX gathers dossier data from publicly accessible sources using manual, automated and AI-assisted research. AI agents help identify, collect, organise and verify records. Each subject is matched against identifiers such as an SEC CIK or registry number, and the sources behind a dossier stay attached to it.
Supporting documents and identity details you attach to a dossier request are used to research that person. What they establish can become part of the dossier, which other clients can read, so attach only what you are entitled to share. A photo you confirm as the subject may be added to that person's dossier.
Holdings and transactions from filings are shown as disclosed. Net worth figures are estimates, whether published by others, such as Forbes, or made by DossierX, even where a summary shows the figure without that label.
Permitted sources
- Regulatory filings — SEC EDGAR (proxy statements, Forms 3, 4, 144, 8-K, 13D/G, 13F, Form D, Form ADV).
- Corporate and charity registers — state business registries, Companies House, IRS Form 990 filings.
- Court records and published judgments.
- Political-contribution records published by election regulators, such as the FEC.
- Property records published by county assessors and recorders.
- Trade and industry references and professional directories.
- Print and broadcast media, press releases and company websites.
- The subject's own published statements and public profiles, including professional and social networks.
Excluded sources
DossierX does not set out to use these, and clients must not feed them into DossierX. Most of its research filters out the people-search sites and contact-data brokers below, but not every build does yet, so a dossier may occasionally cite one; report it as an inaccuracy (section 8).
- People-search sites (Spokeo, BeenVerified, Whitepages and comparable), and contact-data brokers such as ZoomInfo, RocketReach and Lusha.
- Leaked, hacked or stolen data, or anything obtained by deception (pretexting).
- Private social accounts, or other non-public content obtained without authorisation. Documents you are entitled to share and attach to a request are not excluded.
- Credit reports or consumer reports regulated under the Fair Credit Reporting Act.
4. Roles and Responsibilities
DossierX and each client are independent controllers of dossier data. DossierX is responsible for how it researches, verifies, secures and retains that data; you are responsible for whom you research and what you do with the result.
| Area | DossierX | Client |
|---|---|---|
| Purpose of research | Provides the service for professional relationship development | Decides who is researched and documents a legitimate purpose |
| Lawful basis | Maintains its own basis for compiling public-record data | Records its basis for each use |
| Sources and accuracy | Aims to research only from permitted sources, within the limits in section 3; shows the sources behind each dossier; corrects errors when told | Reports inaccuracies; does not add data from excluded sources |
| Transparency | Publishes this guideline and its Privacy Policy | Tells data subjects about the processing where law requires, for example in its own privacy notice |
| Security of the workspace | Secures the platform and keeps each organisation's private data from other clients | Decides whom it invites to its workspace and secures its own devices and AI environment |
| Rights requests | Assists and actions deletion or correction in DossierX | Responds to requests addressed to the client |
For client workspace data — your notes, watchlists and imported contacts — DossierX acts as a processor on your instructions, under a data processing addendum available on request.
5. Sensitive Data, Discretion and Minors
DossierX does not research the sensitive characteristics below, and it is not for researching children: clients must not request a dossier on anyone under 18.
Not researched
DossierX does not set out to research these. A published source cited for another reason may still mention one, and a dossier may list sensitive topics that published sources raise, to be handled with care when engaging the subject. A dossier's profile may show the age, gender and citizenship that published sources or data providers report.
- Health or medical information, including disability.
- Racial or ethnic origin, religious or philosophical beliefs, or sexual orientation.
- Trade-union membership or genetic data.
- Government ID numbers, bank or card account numbers, passwords or credentials.
Political contributions on public record may appear as fact — amount, date and recipient. A dossier may also show a party affiliation, policy positions and lobbying ties where published sources report them.
Discretion required
- Family.Relatives and marital status appear where a published source names them, which can include a subject's children. Clients must not research a minor in their own right.
- Homes. Residences and property appear where published records or reporting cover them, as those sources give them. A home must never be used to locate or visit the subject.
- Contact details. Dossiers are not designed to provide personal contact information. A dossier may list professional channels that published sources give, such as an office or a representative. DossierX does not set out to use people-search sites or contact-data brokers (section 3). If a dossier shows a personal email address, phone number or other personal contact detail, report it as an inaccuracy (section 8).
- Litigation, criminal matters and allegations. Court records are reported with their outcome where known. Allegations and controversies from published reporting may appear as adverse findings, with the reporting they came from.
Accuracy and identity
Common names are the main source of error. Each subject is anchored to identifiers such as an SEC CIK, a registry number or a known employer. If the subject's identity cannot be confirmed with enough confidence, the build stops and no dossier is published.
6. AI and Connector (MCP) Handling
DossierX sends data to AI models only to run its features, and never trains a model on your data.
- No training. DossierX does not train or fine-tune any model on your workspace data or queries.
- Dossiers first. The assistant answers from DossierX dossiers first and cites the section it draws on. It may add public web results, which are marked as such.
- Model providers. DossierX uses commercial model providers to run its features. They process data only to provide the service, and the current list is available on request.
Using DossierX in your own AI assistant
DossierX is building an MCP connector that will deliver DossierX data to an enterprise AI assistant your organisation already runs, such as Claude Enterprise. It is not yet available. When it is, responsibility will split at the connector.
| Layer | Governed by |
|---|---|
| Your AI assistant, its chat history, retention, audit logs and training settings | Your contract with that AI provider and your own policies |
| The DossierX connector, the data it returns, its authentication and logging | DossierX, under these guidelines and your agreement |
The DossierX connector is being built to be:
- Read-only. It will return dossier data and cannot change records in your systems.
- Authenticated per user through OAuth, tied to your identity provider where supported.
- Tenant-scoped.Each user will see only your organisation's workspace.
- Logged. Every tool call will be recorded, so you can see what data was released to the assistant and to whom.
Once data reaches your assistant, your organisation's own retention and sharing settings apply to it. Your administrators should confirm those settings before enabling the connector.
7. Security, Access and Retention
Access controls keep each organisation's private data from other clients, and you can have it deleted.
Security controls
- Access controls on every request; no client can see another's notes or questions, or a watchlist that was not shared with them.
- Encryption in transit. Data at rest is encrypted by our hosting providers, and DossierX also encrypts the OAuth tokens for connected sources.
- Sign-in through a dedicated identity provider.
- Access by DossierX staff limited to support, review and security, through a role-controlled console.
- Service providers for hosting, AI models, search, email, sign-in and monitoring, bound by written confidentiality and data-protection obligations.
Retention and deletion
- Workspace data is kept while your subscription is active. You can delete your own notes, watchlists, alert rules and imported contacts at any time.
- On request, or at the end of your agreement, DossierX deletes your workspace data and confirms in writing, except where the law requires a record to be kept.
- Disconnecting a contacts source stops future syncs. Previously imported contacts are deleted on request.
- When your purpose for a dossier ends, remove it from your watchlists. Ask DossierX if you believe the dossier itself should be deleted.
Assurance and compliance
- DossierX designs the service to meet US state privacy laws, including the CCPA/CPRA.
- Security by design, staff privacy training, regular penetration testing and a patch and vulnerability management process.
- Privacy policies reviewed at least annually and whenever the law changes, with privacy overseen at leadership level.
8. Individual Rights, Incidents and Contact
Anyone DossierX holds data about can ask to see, correct or delete it, and we act on valid requests promptly.
- Access, correction, export and deletion. Requests go to the contact below and are handled within the timescales the law sets. Where a request reaches you about data held in DossierX, forward it to us and we will help you meet your own deadline.
- State privacy rights. Californians and residents of other states with similar laws can exercise the rights those laws give them through the contact below, including opting out of any sale or sharing of their personal information.
- Corrections flow through. Alerts are withdrawn when their evidence no longer holds, and dossiers reflect a correction at their next update.
Security incidents. If a breach affects personal data in your workspace, DossierX notifies you without undue delay and gives you what you need to meet your own notification duties.
Contact. DossierX, Inc. — jonathan@dossierx.ai
9. Client Acceptable Use
DossierX is for professional relationship development: engaging, contracting and retaining high net worth individuals and clients, as the Terms of Service set out. Any other use breaks these guidelines and your agreement.
Clients must not use DossierX to:
- Make decisions about credit, insurance, employment, housing or tenancy.
- Locate, track, harass or contact anyone against their wishes, or to visit a home uninvited.
- Research children, or research anyone on sensitive characteristics.
- Resell, publish or bulk-export dossiers outside your organisation.
- Enrich DossierX with data from excluded sources.