Trust
What we do to protect your investors' data
This page lists controls that exist in the platform design and states plainly what is not yet complete.
Status
Certifications
We do not hold a SOC 2 report today. SOC 2 is on the roadmap and our controls are mapped to its criteria. We will publish the report here when it exists.
Penetration testing
An external penetration test is planned before the first paying customer and then every year. A summary will be published here. Automated scanning of our staging environment runs weekly.
Uptime
Current availability and incident history are on the status page.
Controls
Security controls
Grouped by area. Each line describes a control that the platform is built to enforce.
Identity and access
- No passwords. Passkeys (WebAuthn), email links, Google sign-in and authenticator-app codes.
- Email links are single use, expire in 15 minutes and are bound to the device that requested them.
- Staff must enroll a strong factor during invitation. Investors follow the strictest multi-factor policy among the funds they belong to.
- Step-up verification within five minutes for bank details, signing, tax downloads, email changes, factor changes, access grants and money approval.
- Opaque 256-bit session tokens in host-only cookies, stored as hashes, rotated on privilege change, with idle timeouts of 30 minutes for investors and 15 minutes for staff.
- Device list with revoke one or revoke all.
- Role-based permissions checked on every server action and route, with per-fund scoping.
Tenant isolation
- A tenant identifier on every tenant table, with composite foreign keys.
- PostgreSQL row-level security in force mode, with the application connecting as a non-owner role.
- An application-layer data access guard that refuses unscoped access to tenant tables.
- A continuous integration test that seeds two tenants and verifies that no table returns the other tenant's rows.
- Cross-tenant code paths exist only through an audited helper that records a reason.
Data protection
- TLS 1.2 or later, HSTS with preload, and encryption at rest.
- Envelope encryption: a cloud key management service wraps a per-tenant data key.
- AES-256-GCM field encryption for tax IDs, bank account and routing numbers, dates of birth and ID numbers, with blind indexes for lookup.
- Decryption only through a gated module that requires a separate permission.
- Deletion by crypto-shredding where financial and audit records must be retained.
- Data stored in the United States.
- Point-in-time recovery for the database and a quarterly restore test.
Documents
- Every upload is scanned for malware before it can be downloaded.
- PDFs are sanitized to strip scripts and attachments.
- Files are served from a separate origin in a sandboxed viewer.
- Download links are generated after an authorization check and expire after 60 seconds.
- Unguessable identifiers, server-derived storage keys and no bucket listing.
- Views and downloads are logged and retained for seven years.
Money movement
- Maker-checker approval on calls, distributions, statements, payment initiation, bank changes and period close.
- A payment authorization recorded for every capital call debit.
- A cooling period on newly linked bank accounts and per-fund limits on debit size.
- Wire instructions are shown only inside the signed-in portal after step-up. Emails say to sign in.
- A fund's bank detail change needs two approvals and alerts its investors.
- We never hold investor funds.
Audit
- An append-only audit log that the database refuses to update or delete.
- Each event is chained by hash to the previous event, with a nightly chain verification.
- Authentication events, authorization denials, sensitive actions, data writes with before and after values, exports and impersonation are all recorded.
- Retention: audit events seven years, authentication events two years, request logs 90 days.
- Fund owners and auditors can view and export their own stream. Investors see a security activity page.
Platform and operations
- Cloudflare web application firewall, managed rules, rate limits on sign-in and file routes, and bot mitigation.
- A nonce-based content security policy, frame protection, a strict referrer policy and a restrictive permissions policy.
- Support impersonation requires a reason, is capped at 30 minutes, shows a banner, blocks writes, is audited and notifies the investor.
- Outbound webhooks are signed with HMAC-SHA256 and a timestamp, with replay protection on inbound webhooks.
- Custom domains require a DNS ownership proof, and unknown subdomains return not found.
- Dependency updates weekly, vulnerability audits, static analysis and secret scanning in continuous integration.
- Email authentication with DKIM, SPF and DMARC set to reject.
- Error and request monitoring with personal data scrubbed.
Need a security review?
We will answer a questionnaire and walk your team through the architecture.