Shortcut

The agent is the product. Shortcut plans a task, writes the formulas and formatting, and checks its own output in a separate verification step. No workflow system or data asset sits underneath that would remain if the models were removed. What a customer buys is the ability to hand modeling work to software and get back a working spreadsheet, and that only exists because of the inference.

The product is built to finish substantial work from a single instruction, so the main oversight tool is the output itself. Results are written as formulas a reviewer can audit rather than as hard coded values, and the company describes human review at every step as part of the design. Teams and Enterprise plans add role based permissions, usage analytics and administrator control over which model keys and gateways the agent uses.

What is not published is an approval step before the agent edits a live workbook, a confidence threshold that hands a task back to a person, or a list of actions the agent will not take. Both independent tests found the output still needs real human rework before use, which makes that review the control that matters.

Models come out as formulas rather than pasted numbers, so every figure in an output can be followed back to the calculation that produced it, and the agent checks its work in a separate verification step before handing it back. Outside parties have tested the product in public with stated methods, and their results include failures: one test saw invented historical figures on its first attempt, and every tool tested, this one included, failed to handle interest circularity. The company's own claim of more than 90 percent formula accuracy comes with no published method, and no policy for monitoring quality as the underlying models change is stated.

A named customer reports measured results. TresVista ran a 45 day pilot before embedding the agent across its modeling and research work, and reported roughly 25 percent average gains at the execution stage, 25 to 35 percent gains in review, and some workflows running five times faster, with its co chief executive quoted by name. Two independent tests add outside evidence.

Wall Street Prep ranked Shortcut first of four tools at building a three statement model from public filings, and the Office of the CFO team at Ankura ranked it first of five tools across three modeling scenarios. Both reports also record weaknesses: Wall Street Prep saw invented historical figures on a first attempt, and Ankura found that no tool produced a model ready to use without rework.

The training terms are published and specific, with a split by plan that buyers should notice. Teams and Enterprise data is never used to train models. Individual Pro accounts have a Help improve Shortcut setting that is on by default, under which conversations, the workbook content the agent reads and writes, and its actions may be kept, used for training and shared with partners working on those improvements. Switching it off applies only to conversations started afterwards. Conversations in Google Sheets, through a private gateway, or stored in storage the customer owns are never kept for training, and enterprise customers can request zero data retention.

A detailed privacy policy sets out what is collected, why, who receives it and for how long. Data goes to hosting, deployment and model API vendors described as SOC 2 certified or equivalent, model providers keep request data for up to 30 days for safety monitoring, and enterprise customers can ask for zero data retention.

Users can access, correct, delete and export their data, and data processing agreements, service level agreements and business associate agreements are listed among the legal documents available. The named subprocessor list is not public, and nothing addresses the Gramm Leach Bliley Act or how a bank's client information inside a workbook should be handled.

A SOC 2 Type II examination by an independent auditor is complete, with the report available on request through a trust center run on Vanta, alongside a public security and compliance questionnaire, terms and privacy policy. Published controls include 256 bit AES encryption at rest, TLS encryption in transit, SAML single sign on with Okta, Azure AD and Google Workspace, role based access control, audit logging, real time threat detection, daily backups and failover across availability zones. The company also states GDPR and CCPA compliance.

Shortcut holds no license, registration or supervised status, and none would be expected for a modeling tool. Its customers are regulated, though, and the models it helps build can feed valuations, credit work and client materials that sit inside their obligations. Nothing published addresses that boundary or how a regulated firm should document agent built work for examiners.

No governance framework, testing regime or bias evaluation for the agent is published beyond a trust center heading that mentions model security and validation. The relevant risk in modeling work is less about protected classes than about judgment calls: which assumptions the agent chooses, which historical figures it uses when sources disagree, and how it fills gaps. None of that is described.

No liability position, accuracy warranty or remediation route for errors in agent built models is published. Enterprise contracts offer custom terms and service level agreements, which cover availability and support rather than the correctness of the output. An error here lands inside the arithmetic of a valuation or a deal model, and nothing published says who bears it.

The model suppliers are named, and customers can control them. Shortcut's own write up of the Ankura test states that its free tier runs on MiniMax. Enterprise customers can run the agent on their own Anthropic API keys, covering current and future Claude models, with OpenAI and Google keys described as coming later, and can send all model traffic through a private gateway they control. The privacy policy also describes automatic failover across multiple model APIs. A buyer can see who supplies the models, bring its own contract with the main provider and decide where requests go. The model behind the standard Pro and Teams plans is not stated outright.

The agent meets analysts where the work already lives: an Excel add in listed on the Microsoft marketplace, a Google Sheets plugin, a web app, a Windows desktop app, a command line tool and a platform API. It reads workbooks at the level of cells, formulas and structure rather than as flat text, and writes results back as live formulas. Enterprise customers can commission custom integrations.

No connection to the systems of record that banks and funds run on, such as portfolio accounting or deal management, is described, and the spreadsheet environment itself belongs to Microsoft and Google.

Delivery is a cloud service, and the privacy policy states that all data is currently processed in data centers in the United States, with customers told in advance of any change in location. Enterprise customers get two controls that matter to institutions. They can encrypt stored data with their own keys held in AWS Key Management Service or Azure Key Vault, and they can route every model request through a gateway their own organization controls. No regional choice beyond the United States and no on premises option is published.

The full rate card is public. A free plan includes 20 credits a week. Pro costs $100 a month billed annually, or $125 month to month, for 1,000 monthly credits plus unlimited file creation and edits and API access. Teams costs $320 a month plus $100 per seat a month billed annually, with 1,000 pooled monthly credits, a shared workspace, usage analytics and central billing.

Enterprise is quoted and adds single sign on, custom permissions, customer managed encryption keys, a private model gateway, dedicated support and custom terms. The pricing page also explains the unit: a typical message uses 2 to 15 credits, depending on complexity.

Buyers span investment banks, private equity firms, hedge funds, commercial real estate teams and accounting and finance functions, with published use cases for each. One institutional customer is named: TresVista, an outsourced research and analytics firm serving more than 350 clients across private equity, credit, real assets, public markets, secondaries and banking. A free tier and a self serve individual plan open the product to single analysts, so the base runs from individuals to enterprise teams. No customer count or geographic coverage is published.