Trust & security
Your funding data deserves serious protection
Funding work involves financials, strategy and relationships. These are the controls in place today — described plainly, without certifications we have not earned.
Tenant isolation in two layers
Every API request is checked against your workspace membership and role, and PostgreSQL row-level security independently restricts each query to your workspace.
Verified identity
Accounts use Firebase Authentication with verified email addresses. Server-side checks validate every session token; roles are never trusted from the browser.
Least-privilege roles
Owners, admins, analysts, contributors, reviewers, billing admins and auditors each receive only the permissions their work requires.
Append-only audit log
Workspace, membership and billing changes are recorded with actor and time. Audit entries cannot be edited or deleted from the application.
Encryption
Data is encrypted in transit with TLS and at rest in managed AWS storage. Secrets are kept in AWS Secrets Manager, never in source code.
Branded, single-use email links
Verification, password-reset and invitation links are sent from our own domain, expire, and work only once.
Payments separated from funding
Subscription billing is handled by Stripe. Card details never touch our servers, and investment or loan funds are never processed through subscriptions.
Human approval for consequential actions
Outreach, submissions and binding offers require explicit approval. Regulated activities stay disabled until licensed partners and counsel approve them.
Found a security issue? Please report it through our contact page with the topic “Support”. We do not currently hold SOC 2 or ISO 27001 certification and will not claim to until an independent audit is complete.