Consark is now Consarc. A note from our CEO on why. Read the note.
Automated data ingestion
Pulls updated POs, invoices, usage logs, and spend data automatically to prevent missing inputs.
Policy-driven accruals
Applies your timing, threshold, and mapping rules automatically for consistent, audit‑friendly accruals.
Automated schedules
Creates clean schedules with logic, period splits, and documentation, eliminating manual spreadsheet work.
Accurate period-end entries
Generates entries with transaction‑level detail so reviewers instantly see the logic behind every number.
Continuous carry-forward
Rolls balances forward automatically across periods, removing rebuilds and keeping teams aligned throughout.
Secure by design
Consarc is a multi-tenant platform built with layered controls acrossidentity, network, application, and data. No single control carries the load onits own.
Edge Protection
Blocks malicious traffic before it reaches our application.
App Enforcement
Tenant validation & strict data isolation.
Tenant-Aware Access
Your dedicated subdomain, your security controls.
Private Service Networking
Secure communication between our services.
Enterprise Identity
Seamless & secure access with your identity provider.
Data & Operational Security
Your data is protected always
Identity and access
Enterprise SSO via SAML
Your team signs inthrough your own identity provider, with a dedicated configuration for eachcustomer.
Your team signs inthrough your own identity provider, with a dedicated configuration for eachcustomer.
MFA through your identity provider
If your identityprovider enforces multi-factor authentication, it applies to Consarcautomatically.
If your identityprovider enforces multi-factor authentication, it applies to Consarcautomatically.
Least-privilege access.
Access acrossinfrastructure, services, and administration is limited to what each roleneeds.
Access acrossinfrastructure, services, and administration is limited to what each roleneeds.
Network
Web application firewall
Malicious traffic isdetected and blocked before it reaches the application.
Malicious traffic isdetected and blocked before it reaches the application.
Dedicated tenant subdomains
Each customer gets itsown subdomain, enabling tenant-aware routing and controls such as IPallowlisting.
Each customer gets itsown subdomain, enabling tenant-aware routing and controls such as IPallowlisting.
Private service-to-service communication
Backend servicescommunicate over private channels, reducing public exposure.
Backend servicescommunicate over private channels, reducing public exposure.
How we protect your data
Consarc is a multi-tenant platform built with layered controls acrossidentity, network, application, and data. No single control carries the load onits own.
Protected at every layer
AES-256 encryption at rest.
Your ledger data is encrypted wherever it's stored.
Your ledger data is encrypted wherever it's stored.
TLS 1.2+ encryption in transit.
Every connection between your systems and Consarc is encrypted.
Every connection between your systems and Consarc is encrypted.
Strict tenant isolation.
Every request is validated against the tenant in its authentication token, and authorization is enforced at the application layer.
Every request is validated against the tenant in its authentication token, and authorization is enforced at the application layer.
Data hosting.
Customer data is stored in data centers in the United States for global customers, or in data centers in India for customers based in India.
Customer data is stored in data centers in the United States for global customers, or in data centers in India for customers based in India.
No password storage.
We connect to your ERP and banks through OAuth or scoped API tokens, never your passwords. Tokens are encrypted in a secrets vault.
We connect to your ERP and banks through OAuth or scoped API tokens, never your passwords. Tokens are encrypted in a secrets vault.
Your data belongs to you
Zero model training.
Your data is never used to train, fine-tune,or improve any AI model.
Your data is never used to train, fine-tune,or improve any AI model.
Deletion on demand.
Request removal of your data at any time. We delete it within [30] days and purge it from backups within [90] days.
Request removal of your data at any time. We delete it within [30] days and purge it from backups within [90] days.
No selling.
We never sell your data. We share it onlywith vetted subprocessors, under contract. The full list is available onrequest.
We never sell your data. We share it onlywith vetted subprocessors, under contract. The full list is available onrequest.
Tamper-evident audit logs.
Every action is recorded, and any change to the record is detectable.
Every action is recorded, and any change to the record is detectable.
How we run security
Centralized logging and 24/7 monitoring. Activity across the platform is logged in one place, and automated tooling watches for threats and anomalies around the clock, with on-call alerting.
Dedicated security leadership.
A named owner is accountable for security across the company.
A named owner is accountable for security across the company.
Defined incident response.
A documented, tested plan for detecting, containing, and reporting incidents.
A documented, tested plan for detecting, containing, and reporting incidents.
Independent penetration testing.
Third-party testersprobe the platform annually.
Third-party testersprobe the platform annually.
Daily encrypted backups.
Your data is backed upevery day and encrypted at rest.
Your data is backed upevery day and encrypted at rest.
Vulnerability management.
Continuous scanning,with critical patches applied within defined SLAs.
Continuous scanning,with critical patches applied within defined SLAs.
Vetted, trained people.
Every employee passes a background check and completes security training on joining and every year after.
Every employee passes a background check and completes security training on joining and every year after.
Breach notification.
Affected customers are notified within 72 hours of a confirmed incident.
Affected customers are notified within 72 hours of a confirmed incident.
Guardrails for Noa agents
Consarc is a multi-tenant platform built with layered controls acrossidentity, network, application, and data. No single control carries the load onits own.
Automatic lease extraction
Reads contract data and fills lease terms, frequency, increments, deposits, and key commencement details
Full schedule generation
Builds complete amortization tables with interest, payment splits, and right‑of‑use asset movements.
Lease lifecycle management
Tracks renewals, closures, modifications, and reassessments, applying changes accurately every period.
Audit‑ready journal entries
Produces each period’s journal entry with linked support, ensuring clarity, consistency, and traceability.
Contract‑to‑schedule linkage
Allows reviewers to trace every value directly back to its originating contract for full transparency.
Nothing posts without your approval
No journal entry, reconciliation, or adjustment reaches your GL withoutexplicit sign-off from an authorized user. This is enforced in thearchitecture, not left to configuration.
Scoped to finance close work
Noa agents perform defined accounting tasks against structured financialdata. Nothing outside that scope.
Exceptions go to people
When a Noa agent hits missing data, ambiguity, or a value outsidethreshold, it stops and flags the item for human review. Nothing gets buried.
Compliance and certifications
Controls, security, and auditability are built into every workflowConsarc runs.
Report available under NDA
Report available under NDA
Compliant
Certified
Automatic lease extraction
Reads contract data and fills lease terms, frequency, increments, deposits, and key commencement details
Full schedule generation
Builds complete amortization tables with interest, payment splits, and right‑of‑use asset movements.
Lease lifecycle management
Tracks renewals, closures, modifications, and reassessments, applying changes accurately every period.
Audit‑ready journal entries
Produces each period’s journal entry with linked support, ensuring clarity, consistency, and traceability.
Contract‑to‑schedule linkage
Allows reviewers to trace every value directly back to its originating contract for full transparency.
FAQ
What does Consarc consider customer data?
Any information we ingest from, process for, or generate on behalf of your financial systems. That includes GL transactions, journal entries, bank statements, reconciliation records, supporting documents, and outputs prepared by Noa agents. All of it is classified and handled as Customer Confidential.
How does sign-in work?
Consarc supports enterprise SSO via SAML, so your team signs in through your existing identity provider. Any MFA policy your identity provider enforces carries over to Consarc automatically
Can we restrict access to specific IP addresses?
Yes. Each customer runs on a dedicated subdomain, which lets us apply customer-specific IP allow listing.
How is our data kept separate from other customers?
Every request is checked against the tenant identified in its authentication token, and authorization is enforced at the application layer before any data is returned.
Is Consarc GDPR compliant?
Yes. We process personal data in line with GDPR, including support for data subject requests, data deletion on demand, and a Data Processing Agreement for customers who need one.
Can we see your SOC reports?
Yes. Our SOC 1 Type II and SOC 2 Type II reports are available under NDA. Request access through your Consarc representative or email us at security at consarc dot ai.
Can we see your security policies and subprocessor list?
Yes. Both are available on request through your Consarc representative. Some documents are shared under NDA.
Where is our data hosted?
Customer data is stored in data centers in the United States for global customers, and in data centers in India for customers based in India. Any access from outside the hosting region, including by our support team, is governed by our Data Processing Agreement and Standard Contractual Clauses.
How do you make sure our data isn't used to train AI models?
Our agreements with model providers, including OpenAI, Anthropic, and Google, prohibit training, fine-tuning, or retaining customer data. All model usage is inference-only with zero data retention configured.
Who at Consarc can access our data?
Access follows zero-trust and least-privilege principles, enforced through role-based and attribute-based controls. Our security team reviews access quarterly, and permissions are removed within 24 hours of a role change or offboarding.
.png){kind=spacer}
Consarc.ai Inc
#447 Broadway, New York, NY 10013
#447 Broadway, New York, NY 10013
