Intapp

The models are a layer over a business that stands without them. DealCloud remains a purpose built private capital relationship and deal platform. Conflicts still checks conflicts and Walls still enforces information barriers. Time still captures time and Billstream still bills. That is a company founded in 2000 with most of its revenue intact. Celeste is a real agentic layer with its own runtime, but it rests on that portfolio rather than constituting it, and Applied AI is a set of signals over an existing customer relationship system.

Oversight is drawn as a bright line rather than a claim. The mechanism is named, positioned in the execution path, and carries a stated default: reads execute inside each user's own permissions without prior approval, and every write that creates, modifies or deletes data in a connected system requires explicit user approval before execution. Permissions are enforced at the connector level and carried through every execution step.

Material non public information, insider lists and information barriers are checked before every playbook run, including playbooks published outward through the interoperability protocol, and the check happens before data reaches any third party surface. Scheduled playbooks act on behalf of a named user with a delegated subset of that user's permissions and no credential elevation.

Playbooks constrain the agent to approved tools, deterministic tools perform fixed operations over the firm's own data, and the agent stops and asks for clarification when a match is ambiguous rather than guessing. Administrators control what is published and new playbooks can be tested before release.

The controls are real and published plainly. Playbooks define goals, guardrails and approved tools. Deterministic tools perform fixed operations grounded in the firm's own data rather than generated ones. The agent halts and requests clarification on an ambiguous match instead of resolving it silently, content safety screening filters inputs and outputs, and playbooks can be tested before release to users.

The vendor also publishes a product terms disclaimer and tells users plainly to evaluate outputs for their own use case. None of it is model documentation. There is no accuracy or error rate, validation report or benchmark. There is no drift policy and no statement of how playbook behavior is monitored once released.

Clients are named, but none is joined to a quantified outcome. One is a private equity firm with $6.5 billion under management, with a named executive quoted on the selection, and a named advisory firm is cited on the product page. Industry voted awards for deal origination in credit came in both United States and European programs, decided by thousands of practitioner votes rather than purchased, a real if soft independent signal.

The one quantified figure, a pipeline expansion percentage over six months, is attached to an unnamed fund on the vendor's own blog. A client stories library is published as a separate filtered resource collection and is not reflected here.

Client data is never used to train models and never shared across firms, and prompts are never shared or combined across tenants. The architecture is named (playbooks, skills, connectors, a context engine over the firm's own terminology, curated knowledge hubs that preserve existing access controls, and ethical wall enforcement inside the agent runtime). Data sources are enumerated by connector. Model hosting policy is stated, with each provider's models named against its hosting platform.

On suppliers, both model providers are bound by contractual use limits and deletion commitments. Lifecycle terms cover the rest: data is held for the agreement plus a retention window then permanently deleted, and prompts and outputs are excluded from training. The one gap is precision, since the retention and purge windows are described rather than given as specific figures.

Privacy posture is comprehensive and verifiable. Two privacy certifications are held and downloadable: ISO 27018 for personal information processed in the cloud and ISO 27701 for privacy information management. A Global Privacy Recognition for Processors certificate covers the company as a processor. A complete sub processor list, a data processing addendum and a separate vendor addendum are all published.

Residency is stated concretely by region, and retention and deletion terms are stated. Tenant isolation is implemented across products, and prompts are never shared or combined between tenants. The model providers themselves are bound by contractual use limits and deletion commitments, which extends the posture one layer down the supply chain.

Six current certifications are each verifiable in one click. ISO 27001, ISO 27017, ISO 27018 and ISO 27701 are all downloadable from the assessing firm's public certificate portal. A Cloud Security Alliance registry certification links to its public registry entry, and a Global Privacy Recognition for Processors certificate completes the set. Independent third party penetration testing runs to a named scheme at least annually.

Encryption is AES 256 at rest and TLS 1.2 or higher in transit, with federally validated key stores. Content safety screening covers inputs and outputs, and pipeline and artifact scanning is continuous. One disclosure stands out: the vendor volunteers that security review responses for its other products do not automatically cover the agentic product, because that product runs as its own deployment with dedicated compute, data stores and access controls.

No buyer would think to ask, and the answer stops an existing attestation from being read too widely. One flaw: the SOC reports are labeled certifications, which is the wrong noun, since that examination produces an attestation report rather than a certificate.

The product holds no license, has had no supervised test by a financial regulator and is enrolled in no program. As a public reporting issuer the company owes disclosure to securities regulators about the business, but that is corporate status rather than supervision of the product. Membership of a government cloud assessment program is disclosed, with the status stated precisely as a member actively pursuing verified offering status. That is membership, not yet standing.

Nothing is published on fairness testing, protected group analysis or performance variation, and this is the one large gap in an otherwise exceptional disclosure. The decisions involved are deal sourcing, target recommendation, relationship scoring and generated outreach, not consumer credit or identity, so consumer protection exposure is far lower than for those uses. That lowers the stakes without closing them.

Recommendation systems that rank which companies and which people a capital allocator sees shape which businesses get funded and which founders get a meeting. A model that scores relationship strength from communication history will reflect whatever patterns sit in that history.

There is no route for an affected party and no published allocation of responsibility for a wrong output. What the vendor does publish is a dedicated product terms disclaimer for generated output, and a disclaimer is the exact inverse of recourse. It allocates risk toward the user and away from the vendor, from a company otherwise generous with commitments. Every commitment it makes runs to the paying firm through contract, and nobody outside that contract has standing.

Two model providers are named, each with its model family, and each is mapped to the platform hosting it, one on Amazon Bedrock and one on Azure. The product is stated to be model agnostic, with administrators selecting from supported models through an admin console and no lock in to either provider. Both providers are bound by contractual use limits. Routing follows the hosting providers' configurations. Resilience is disclosed at the same layer, with multiple providers spread across availability zones and automatic failover, so the inference layer has no single point of failure.

Integrations are specific and named. Connectors reach the vendor's own portfolio plus Microsoft 365, Snowflake and the open web. Identity federates through Okta or Microsoft Entra as system of record over the two standard federation protocols. Connections use authenticated interfaces without storing credentials, and named market data providers are embedded directly in the deal workflow.

The most interesting property points outward: playbooks are published as governed skills through the Model Context Protocol, and the firm's ethical walls and permission controls travel with them into third party assistant tools. The limit is what gets integrated. The systems are the productivity, data and identity stack rather than the institution's books and records, and no fund accounting, administration or core platform is named as a certified connector.

Residency disclosure is detailed and specific. The application runs on Microsoft Azure. The language models are hosted on Amazon Bedrock for the Anthropic models and on Azure for the OpenAI models. United States client data is stored at rest on United States infrastructure and European client data at rest on European infrastructure. Cross region movement is addressed directly and bounded by the data processing addendum.

Four separate regional application instances are published, along with a full sub processor list. Retention runs for the agreement plus a stated retention window before permanent deletion. On premises deployment is stated plainly as not available. Resilience is described too, with multiple model providers across availability zones and automatic failover so there is no single point of failure at the inference layer.

No price, tier, unit or pricing basis is published for any product, and everything routes to a demo request. One commercial commitment is public: a financially backed uptime service level of 99.9 percent, with a premium support option. That is a contractual promise rather than a price.

Segmentation is fine grained. Within financial services the vendor publishes a separate solution page for ten private capital sub segments (private equity, venture capital, private credit and leveraged finance, hedge funds, growth equity, fund of funds, multi strategy, family offices, private wealth, limited partners). Investment banking and advisory gets its own page, with placement agents as a separate sub market.

Real assets get one too, split four ways across equity investors, credit investors and lenders, developers and limited partners. Buyer roles run from deal teams and investor relations to compliance, risk and finance. Operations are global, with offices across three regions and four separate regional application instances. The limit is scope: this is the deal side of finance, with no retail banking, insurance or payments footprint.