Your data and AI
Settings that decide who may see a company's data and what leaves Evenbead. Every one has a safe default and needs no setup; agents and connected AI apps can read them but never change them. (Dated 2026-10-13; ADR-0066.)
AI data settings (Settings, AI and data)
| Setting | Default | What it does |
|---|---|---|
| Allow third-party AI for categorization suggestions (SubQ) | Off | When a bank line has no rule, vendor history or bank category, ask SubQ for a weak suggestion. Sends only the line's description, amount and direction, bank or card, the candidate accounts (at most 20) and how the same vendor was coded before. Evenbead can switch it off for everyone; it is off on the hosted service today. |
| Help improve Evenbead's AI with this company's categorization history | Off | Consent to train shared categorization models on this company's history. No such training runs today. |
| Train a private model for this company | Off | Consent to train a model only on this company's history, for its own suggestions, deleted with the company. No such training runs today. |
The company's owner or CPA changes them (a firm member with the "AI data settings" capability, for a client); turning one on asks you to confirm it's you; turning one off never does. Every change is in the consent log, with the wording's version: Settings, AI and data, or GET /v1/company/ai-consent-log?format=csv. API: GET/POST /v1/company/ai-settings; MCP get_ai_settings, set_ai_setting (agents are refused).
Two-factor sign-in
Firms: "Require two-factor sign-in (passkey or authenticator app) for all firm members" is on for every firm that opened its account since 2026-10-13 and can be turned on in Settings, Security by a firm admin (capability "Require two-factor sign-in"). Companies: the owner can require it for the company's people. While it is required, a person signed in without a second factor reaches only their own security settings until they add a passkey or an authenticator app. An email link is a first factor only. API: GET/POST /v1/firm/security.
Deleting a company
Settings, Delete company (the owner), or the firm console's Deletions (a firm that created a client nobody claimed). An export is offered first and the company's name must be typed. The company is suspended for 30 days and the request can be cancelled; then everything is deleted, bank connections are removed at Plaid, the subscription is cancelled, and a deletion certificate (PDF, with the JSON) is emailed. Encrypted backups age out within 93 days. API: GET/POST /v1/company/deletion, POST /v1/company/deletion/cancel, POST /v1/firm/clients/{id}/deletion; people only, from a browser session.
Audit anchors
See Audit anchors.