Oath client documentation

Last updated: 2026-09-09

Oath verifies the financial records of the funds and companies it audits. This page explains how you give Oath access to your data, what Oath reads, and how Oath protects it.

Oath is operated by Auditless, Inc., which does business as Oath Verified. This page describes how the service works. It is not a contract.

On this page

• How you get access
• What Oath asks you to connect
• What you cannot change yourself
• How Oath protects your data
• If you have a question
• Frequently asked questions

How you get access

Oath is invite-only. Your Oath contact creates your account before you sign in for the first time. You cannot register by yourself, and an account that Oath did not create cannot sign in.

Sign-in needs no password. Give your email address, and Oath sends a sign-in code to it.

Your account covers one organization. If that organization holds more than one fund or SPV, they all belong to that same account. You see only your own organization's data, and not the data of another Oath client.

What Oath asks you to connect

Onboarding usually takes about five minutes. The steps depend on whether Oath audits a fund or an operating company.

For a fund, you:

• Confirm your fund names
• Connect your document storage
• Give Oath access to your fund administration platform
• Connect your bank accounts

For an operating company, you:

• Confirm your company name
• Choose your accounting system
• Upload your books
• Connect your bank accounts
• Connect your documents

Your funds and entities

Oath creates your funds and entities before you sign in, from the details your Oath contact already holds. Onboarding shows you that list, so you can correct it. You can change a name. You can also add a fund that Oath missed.

If Oath audits an operating company, this step confirms your company name instead.

Your accounting system and your books

An operating company chooses its accounting system, then uploads its books: the trial balance, the general ledger, and any other schedule for the period.

Oath reads no accounting system automatically today. You upload the files.

Your documents

You can connect Box, Dropbox, Google Drive, or SharePoint. Oath sends you to your provider to authorize the connection. You never give Oath your provider password.

A connection service holds that authorization for Oath. You can withdraw the authorization at your provider whenever you want.

You then choose which folders to share. Oath reads the folders you choose, and everything inside them. You must choose at least one folder. Oath refuses an empty choice, because an empty choice would let the sync read your whole drive.

Oath uses two operations on your storage: list a folder, and download a file. Oath's software never creates, changes, or deletes anything you store.

To change your folders later, sign in again and go to the document step. Each connection there has a Manage button, which opens the folder picker again.

An operating company can also upload files directly. Oath accepts:

• PDF, up to 50 MB
• Excel and CSV (.xlsx, .xls, .csv), up to 20 MB
• JPEG and PNG images, up to 20 MB

Your browser calculates a SHA-256 checksum for each file it uploads, and Oath stores that checksum beside the file.

Your fund administration platform

Oath supports Carta today. This step is manual.

In Carta, you add Oath as a Service Provider, with the job title Auditor and the Audit role. You choose which entities to share. You also allow fund investment access for your fund. Your onboarding step gives you the exact email address to add, and each setting to choose.

That seat is how you authorize Oath. Carta then gives Oath a service account, which reads the entities and the role you granted. So Oath reads your Carta data directly, and on its own schedule, rather than a person clicking through Carta. An Oath auditor who holds the seat can also read and export everything inside the entities you shared. Both continue for as long as the seat exists. To end them, remove the seat in Carta.

Your bank accounts

Oath connects to your bank through Plaid. Oath requests read-only data. Oath requests no payment product and no transfer product, so Oath cannot move money through this connection.

Oath never receives your bank password. You give it to Plaid. Plaid gives Oath a token that reads your account data, and Oath holds that token in a managed secrets service.

From a connected account, Oath reads:

• The account details: its name, its type, its institution, and the masked account number
• The transaction history, and new transactions as they appear
• The account-holder details your bank holds for the account, which can include a name, a postal address, an email address, and a telephone number
• Balance history. Oath requests 730 days at the first connection, with a balance for each day. Your bank returns as much of that as it holds.

Oath also stores the report that Plaid builds from this data, as a PDF.

Each month, Oath collects your new transactions. Oath also refreshes the most recent 60 days of balances when it needs them.

If your bank does not support Plaid, you can instead create a view-only user for Oath at your bank. In that case Oath holds a login to your bank, and your own view-only setting is what limits that login. Choose Plaid if your bank supports it.

What you cannot change yourself

Some changes need Oath. Write to support@oathverified.com to ask for these:

• Disconnect a bank or a storage connection. You can also withdraw Oath's access yourself, at your bank or at your storage provider, whenever you want.

• Remove a file you uploaded.

• Change who at your organization has the Oath account. Your organization has one account. If that person leaves, ask Oath to move the account.

These are not possible today, for you or for Oath:

• Move a bank account to a different fund. You choose the fund when you first connect the account.
• Remove a fund that Oath created. You can rename it instead.

How Oath protects your data

This section states what Oath can show you. Where a control is not in place today, this page does not claim it.

Your data stays separate

Oath separates each client's data at two layers.

• The database applies row-level security. A session that belongs to your organization reads only your organization's rows.
• The application scopes each query to your organization as well.

Some background jobs must read across clients to do their work: the monthly bank sync, the webhook that receives bank updates, and the callback that completes a storage connection. Each of those runs under an explicit, reviewed exception to the database rule, because the job learns which client it acts for only after it starts. The application layer is what separates clients on those paths.

What that separation prevents is one Oath client reading another client's data. It does not limit Oath itself. Oath staff do the audit work in a separate application, and their accounts can reach client data across Oath. Roles limit what each member of staff can do, and Oath records the actions they take in the platform.

Two accesses sit outside this model, and this page describes them where they happen: the Carta seat you grant, and the bank login you create if your bank does not support Plaid.

Encryption

• At rest: your documents and database records are encrypted at rest by the storage and database services Oath uses.
• In transit: Oath's connections use TLS. Your data does not cross the network in clear text.
• Credentials: Oath holds your bank tokens in AWS Secrets Manager. Oath's other service credentials live in the secret stores of its hosting and infrastructure providers, not in application code.

Where your data is stored

Your documents are stored in a private Amazon S3 bucket that allows no public access. Oath stores each client's objects under a prefix specific to that client. The application reaches a file through a link that expires.

Oath's storage and database run in the United States. For each provider, and the region it runs in, ask your Oath contact.

How Oath uses AI

Oath uses AI to classify documents, to search for evidence, to extract data, and to answer questions about an audit.

• The audit assistant runs on Amazon Bedrock, inside Oath's own AWS account. Bedrock's terms prohibit the use of your data to train models.
• A contracted document-intelligence partner classifies documents and searches for evidence, under data-processing terms.

Oath never sells your data. Oath never uses your data to train a general-purpose, public AI model.

Change control

Application code reaches production only through Oath's automated deployment pipeline, with review. Infrastructure and credential changes are performed by named engineers, following written procedures.

The changelog records the customer-facing changes, with a date for each one.

Analytics

Oath uses a product-analytics service to understand how clients move through onboarding, and to capture errors. It receives:

• The pages you open and the onboarding steps you complete
• Your user account and your email address
• The name of a bank institution when you connect it, and identifiers for the connection
• The elements you interact with, and the text on them. On the screens where you confirm your fund names, or choose folders, that text includes those names.
• Error messages from your browser

It does not receive your bank transactions, your balances, or the contents of your documents.

The companies Oath relies on

Oath depends on other companies to run the service. They belong to these groups:

• Cloud hosting, storage, and AI inference
• Application hosting
• Sign-in and identity
• The database
• Bank data aggregation
• The service that connects your document storage and holds that authorization
• Document intelligence
• Background job processing
• AI monitoring, which receives the prompts Oath sends to a model and the answers it gets back
• Error monitoring and product analytics
• Source control and build automation

Amazon Web Services, Vercel, Clerk, and Neon each hold SOC 2 certification.

For the full list, with each company named and its region, ask your Oath contact or write to support@oathverified.com.

SOC 2, and what to ask for

Oath works toward SOC 2 Type II certification, with an auditor. Oath does not hold a SOC 2 report today. This page does not tell you that Oath's controls have been audited, because they have not been.

Ask your Oath contact, or write to support@oathverified.com, when you need:

• Oath's security policies
• The named list of companies Oath relies on, and their regions
• Oath's answers to a security questionnaire
• A SOC 2 report, once one exists

To report a security problem in Oath, write to support@oathverified.com and say that your message is about security.

If you have a question

Write to support@oathverified.com. Your accounting engineer can also answer questions about your engagement.