Trust Center

Last updated: 2026-04-06 | Next review: 2026-07-06

Security Posture

Encryption in Transit

TLS 1.2+ enforced on all connections. HSTS preload enabled (2-year max-age).

Verified

Encryption at Rest

AES-256 via Convex managed infrastructure.

Verified

Access Control

Capability-based RBAC with admin, editor, viewer, and legal counsel roles per fund.

Verified

SOC 2 Type II

Certification in progress. Sub-processors (Convex) hold SOC 2 Type II reports.

In Progress

Audit Trail

Git-like version control system tracks every fund data change with author, timestamp, and diff.

Verified

Data Processing Agreements

DPAs with all primary sub-processors (Convex, Anthropic, OpenAI, Vercel, Resend).

Pending

Data Flow

User (Browser) │ ├── HTTPS/TLS ──▶ Vercel (Next.js Frontend) │ │ │ └── WebSocket ──▶ Convex (Database + Real-time Sync) │ ├── Fund data (encrypted at rest) │ ├── User accounts │ ├── Chat history │ ├── File storage │ ├── VCS audit trail │ ├── API ──▶ Anthropic (Claude LLM) │ │ └── Processes fund context + user messages │ │ (ephemeral, no training on customer data) │ └── API ──▶ OpenAI (text embeddings) │ └── Processes KB search queries + content │ (ephemeral, no training on customer data) │ └── Email ◀── Resend (transactional email only)

Sub-processor Registry

We notify customers of sub-processor changes. Registry reviewed quarterly.

Sub-processorPurposeData ResidencySOC 2DPA
ConvexReal-time database, serverless backend, file storageUS (Convex Cloud, AWS us-east-1)VerifiedPending
AnthropicLarge language model (Claude) inference for fund building assistanceUSIn ProgressPending
OpenAIText embeddings for knowledge-base searchUSIn ProgressPending
VercelFrontend hosting, CDN, serverless functions, CI/CDGlobal CDN (origin: US)VerifiedPending
ResendTransactional email delivery (OTP verification, notifications)USIn ProgressPending
Slack (Webhooks)Internal alerting for escalations, observability, and beta feedbackUSVerifiedN/A

Contact

For security inquiries, vendor questionnaires, or to request our SOC 2 report:

[email protected]