When the treasurer or the CFO leaves, where does the reasoning go?

No. Keep the one you have. ParetoAlpha reads its exports and sits above it. Addepar, Masttro and Asora are the book of record for what a foundation or family owns; ParetoAlpha is the book of record for what its trustees or principals assumed and decided, and for every number that rests on those. For a family office on Sage Intacct, Bill.com and Addepar it also connects to all three directly and ties them out to each other every night, so the book the reasoning rests on is one that agrees with itself.

An answer is sealed before anyone decides on it: a fingerprint over the content of the book on that date, the policy and judgement rows in force, the engine version, and the question. Any answer from a deterministic path is sealed; an answer from a language model is marked as not sealed, because it cannot be reproduced. 16 ledgers are hash-chained, and each ledger's latest fingerprint goes every day into locked storage kept for 7 years, and onto the public log, where anyone can check a later copy against it. The lock is in compliance mode: no one, us included, can shorten or remove it.

It does not estimate what a public filing returned. The cohort work is holdings facts only: how many names carry a book, what share sits in the ten largest, what was added and let go. Returns would need a market-data licence we do not hold. A number we cannot check does not go on a page. It does not need a live feed to start. The book loads from the exports your custodian, platform or accountant already produces, which is also the version your auditor can follow. Direct bank and custodian connections are built and switch on per client. It brings no index data with it. Comparisons run against the series the client licenses or supplies. The series in the demo are invented, labelled as invented, and the system refuses to attach them to a real client's report. It will not give you an opinion. It computes and records. The hurdle, the reserve, the benchmark and the buckets are the client's and its advisers'; the decision is the trustees' or the principals'. Nothing here is investment advice. It will not guess. Until the figures an answer rests on are on the ledger with a source and an approver, it names the missing input and waits. Once your policy numbers are signed, it answers, and the answer can be checked.

Not without it showing. Assumptions are superseded on a date, never edited or deleted, and the database refuses an overlapping history even from a raw insert. Proofs cannot change without the fingerprint showing it. Decisions are append-only and must point at a proof that exists.

Because a number computed on a default the trustees or the family never chose is the engine's opinion with a dollar sign on it. Until the hurdle, the reserve or whichever inputs an answer needs are on the ledger with a source, it says what is missing and stops.

A contemporaneous record of prudent process: which assumptions were in force, from which document, who approved them, what the number was, and what was decided. That is what the duty of care asks a trustee to be able to show, and it is usually reconstructed from email after the fact.

It is yours. The book can be pulled at any time, by your own people, as it stood on any date, with the hash of every version: no request to us, no exit fee. Every assumption, proof and decision exports as plain rows on request, and your data is deleted on request. Anyone can recompute a proof, but only this record holds what was known and decided on each date, which is the honest reason it is worth more each year.