Trust & Security

We ask for your financials. Here is how we look after them.

Investment readiness work means handling trial balances, bank statements, contracts and payroll. That only works if the handling is disciplined, permissioned and recorded.

Controls in place

Access is granted, never assumed

Every account is invited and approved. Staff accounts carry explicit roles and permissions; founder, investor and advisor accounts are scoped to their own records only.

Two-factor authentication for staff

All staff and administrator accounts require an authenticator app. Recovery codes are issued once, and repeated failed attempts lock the account.

Row-level data isolation

Isolation is enforced in the database itself, not just the interface. A founder's query cannot return another company's rows even if the interface were bypassed.

Document access is logged

Every view and download inside a data room is recorded with who, what and when — so both sides can see exactly what was shared.

Audit trail on sensitive actions

Approvals, merges, permission changes, exports and administrative overrides are written to an immutable activity log.

Managed, backed-up infrastructure

Data is held in managed cloud infrastructure with encryption in transit and at rest, automated backups and least-privilege service credentials.

Your rights over your data

You can request a copy of the information we hold about your company.
You can correct company details yourself in the portal at any time.
You can request deletion of your account; we retain only what law or an active agreement requires.
We do not sell data, and we do not share your documents with investors without your instruction.

Reporting a security concern

If you believe you have found a vulnerability, or you think an account has been accessed without authorisation, contact us immediately. We investigate every report and will tell you what we found.