No write access for the free scan
The free Close Health Score never requests write access, and never requests banking credentials of any kind.
Evidence requires trust
Finance evidence should be handled deliberately.
FlyCFO is designed for minimum access, explicit consent, controlled retention and traceable findings. This page describes only the controls we've actually implemented and verified — not aspirational claims.
How to read this page. Every statement below reflects how FlyCFO actually works today. Where a capability isn't live yet, we say so rather than implying it exists.
01 · No login required
Start without a connection
You never need to log into an accounting system, ERP or bank to get your free Close Health Score.
Ranges and structure only
The Close Health Score is built entirely from ranges and structural answers you choose — revenue band, entity count, systems in use, days-to-close and similar. We do not ask for, and you should never enter, passwords, tokens or ledger data into the score. This is enforced by what the form asks for, not by a promise about what you might type into a free-text box.
02 · Minimum scopes
Read-only access and minimum scopes
When a paid engagement genuinely needs system access, the model is least-privilege by design.
Least-privilege by design
Where the paid Finance Operations Assessment needs system access, it uses a least-privilege, agreed and revocable access model.
Documented before anything is connected
Scopes, purpose and duration of any access are documented and agreed with you before a single connection is made.
03 · Files
File handling and deletion
Said plainly: there is no self-serve file upload on the free Close Health Score today.
No public upload endpoint yet
The free score is answer-only — there's nothing to upload. If a Finance Operations Assessment needs supporting files, such as a close checklist, we agree the exact channel with you directly at that time rather than through an unauthenticated form on this website. Any personal data or evidence you've shared with us — including a Close Health Score result — can be deleted on request at any time by emailing [email protected], per our privacy notice.
04 · Sharing
Result authorization and sharing
A result is private to your own session unless you deliberately create a link — and even then the link is an unguessable, expiring token, never a public or sequential URL.
Private by default, shareable only on request
Your Flight Check result displays in your own authorized session. It leaves that session only if you explicitly ask for it — either "Email me this report" (sent only to the address you provide) or "Get a shareable link", which mints an opaque, unguessable token that expires, can be revoked, is served with no-store and never indexed. There are no sequential result IDs to guess, and access is authorized server-side on every request — never by the scan ID alone. You can delete your scan and its result at any time.
05 · Provenance
Evidence provenance
Every quantitative finding we publish or deliver carries an explicit evidence grade — never presented as unqualified fact.
Customer measured / FlyCFO observed
The strongest grades — your own systems measure it, or we watch it happen directly during delivery.
Controlled test / Customer reported
Reproduced against a fixture, or told to us directly — useful, but not independently verified.
Estimate
The grade for the free Close Health Score and any early ranges — a projection, not an observation.
06 · AI use
AI use and limitations
The free score isn't an AI guess. The one place AI is actually used is scoped and cited.
Deterministic score, cited skill
The free Close Health Score is computed by versioned, deterministic rules (v1) — the same inputs always produce the same score, and no language model is involved in generating it. The AI finance skill delivered as part of the paid assessment is grounded in your own numbers and policies, and every answer it gives is cited back to its source rather than generated as an unsourced guess.
Said honestly
What we don't claim
We'd rather list what we haven't earned than let a vague phrase imply it.
- No SOC 2, ISO 27001 or other security certification — none has been completed or audited.
- No "bank-grade encryption" or other unverified encryption marketing claims.
- No specific data-residency guarantee beyond what's stated in our privacy notice.
- No claim that uploaded or connected data trains any third-party AI model.
- No public result links — sharing is opt-in and uses opaque, expiring, revocable tokens — and no read-only connector scopes that aren't live yet.
07 · Contact
Security or privacy questions
Reach us directly — a real person reads this inbox.
Start with evidence
See the same discipline applied to your own close.
No connection required to get your free Close Health Score.