Documents and coverage
Native PDFs, scans, spreadsheets, attachments, and tax forms parsed inside the firm's environment, with page and cell provenance, explicit coverage, and an opaque region treated as unsafe rather than empty.
Updated July 2026
Client material arrives as native PDFs, scans, photographs of statements, spreadsheets with live formulas, and mail threads with attachments. All of it is read inside the firm's environment before any release decision is made, and what could not be read is stated rather than assumed away.
What the firm's material actually looks like
Document ingress handles native PDFs, scanned PDFs and images, Outlook messages and their attachments, spreadsheets and their formulas, CSV, XML, JSON and plain text, structured tax forms and provider-native formats where a parser exists for them, and archives and embedded objects subject to firm policy.
Parsing, optical character recognition, layout analysis and table reconstruction all run inside the firm's environment. No document is sent to an outside service to be read.
Every extracted unit keeps its provenance
| Recorded for each unit | Example |
|---|---|
| Document and source object | The K-1 received on the client thread |
| Page, sheet or attachment | Sheet 2 of the depreciation workbook |
| Bounding region or cell | The box holding ordinary business income |
| Reading order and structure | Its position in the form, not just in the text |
| Parser and version | Which extractor produced it |
| Confidence | How certain that extraction is |
| Reference to the original bytes | The exact file it came from |
Provenance is what lets a preparer click a figure in a review artifact and land on the region of the page it was taken from.
Coverage is stated, not assumed
Each document carries an explicit account of what was processed and what was not:
- pages processed, and regions accounted for;
- sheets hidden or skipped;
- images with no extracted semantics;
- corrupt objects;
- password-protected sections;
- content the provider truncated;
- unsupported encodings.
An opaque region is treated as unsafe for external release, never as empty. A scanned page that failed recognition narrows the route the work may take; it does not quietly become a blank.
One client's document cannot enter another client's work
Every document is bound to a candidate client and engagement scope before it is used. Ambiguous scope is resolved inside the firm or returned to the preparer as one plain clarification.
Two clients with similar names, a shared address, or a file that landed in the wrong folder do not merge. No document reaches another client's work through search, a cache, an embedding, or an agent's memory.
Untrusted formats are parsed under containment
Documents arrive from outside the firm and are treated as data throughout. Parsers run under bounded processor time, memory and output size, with active content and macros disabled, on isolated temporary storage that is cleared afterwards. A link inside a document never causes an outbound fetch.
Errors from this stage carry no document content.
Where to go next
| To understand | Read |
|---|---|
| Which systems the documents come from | The systems Connect joins |
| What coverage decides about the route | Where each part of the work runs |
| Where the preparer sees the document itself | The private workspace |
| What the model receives instead | What the model sees |