Trust Center

Last updated: 2026-10-28 | Next review: 2027-04-28

Security Posture

Encryption in Transit

The web app and public pages are served over HTTPS by Vercel, and the Platform talks to its database over TLS. Convex and Vercel encrypt data in transit with TLS.

Verified

Encryption at Rest

Convex encrypts all customer data at rest (database, file storage, and search indexes) with 256-bit AES.

Verified

Access Control

Role-based permissions with owner, admin, and member roles per workspace. Outside counsel reach a fund only through an engagement on its legal matter.

Verified

Connected AI Agents

Customers connect their own AI agents over MCP, authorized with OAuth. Each grant names its funds, its mode (read, suggest edits, or edit directly), and whether it sees legal documents or investor contacts; workspace owners and admins can cap any fund. Revoking a grant stops access at the agent’s next call, and one switch turns all agent access off.

Verified

SOC 2

Fund Launch does not hold a SOC 2 report of its own. Convex and Vercel, which run the Platform’s database, backend, and hosting, each hold a SOC 2 Type 2 attestation.

Not Certified

Change Control

Every change to the Platform is a signed commit, and reaches production only after our full automated test suite passes on it in CI. Deploys and rollbacks run from CI, and access to production systems and keys is limited to named people.

In Place

Audit Trail

An append-only change log records every fund data change with its author and time, and drives undo and redo. Connected AI agents’ reads and refused calls are logged too.

Verified

Data Processing Agreements

Our Data Processing Agreement is available on request: email [email protected]. Each sub-processor’s own terms are linked in the registry below.

On Request

Data Flow

User (Browser)
  │
  ├── HTTPS/TLS ──▶  Vercel (web app and public site)
  │                    │
  │                    └── WebSocket ──▶  Convex (Database + Real-time Sync)
  │                                         ├── Fund data (encrypted at rest)
  │                                         ├── User accounts
  │                                         ├── Chat history
  │                                         ├── File storage
  │                                         ├── Change log and agent access log
  │                                         ├── Convex AI Gateway ──▶  Anthropic (Claude models)
  │                                         │                           └── Processes fund context + user messages
  │                                         ├── API ──▶  Stripe (payments and subscriptions)
  │                                         ├── API ──▶  Resend (transactional email only)
  │                                         └── API ──▶  Linq (texts, only for linked phones)
  │
  ├── OAuth ──▶  Google (sign-in, only if you choose it)
  │
  └── Email ◀──  Resend

Your AI agent (Claude, ChatGPT, Cursor…)
  │
  └── MCP over HTTPS, OAuth token ──▶  Vercel (/mcp) ──▶  Convex
                                         └── Only the funds, mode and data you granted

Sub-processor Registry

We update this registry before adding a sub-processor, and review it at least every six months.

Sub-processorPurposeData ResidencyTheir Terms
ConvexReal-time database, serverless backend, file storage, and the AI Gateway through which we reach AI modelsUS (AWS)Terms, Privacy, Security
AnthropicLarge language model (Claude) inference for the assistant and document reading, reached through the Convex AI GatewayAs routed by the Convex AI GatewayCommercial Terms, Privacy
VercelHosting for the web app and public site, CDN, serverless functionsGlobal CDN (origin: US)Privacy, Security
StripePayments and subscriptions. Card details are entered on Stripe’s checkout pages and never reach usUSPrivacy
ResendTransactional email delivery (sign-in and verification links, password resets, reminders, notifications)USPrivacy
GoogleSign in with Google (name, email address, and profile photo only), for users who choose itGlobalPrivacy
LinqText messages, only for people who link a phone; in pilot, on only where we have turned it onUSPrivacy

Intercom (in-app support chat) and Google Calendar (meeting invitations for advisor sessions) are built into the Platform but switched off. We will add each here before turning it on.

Contact

For security inquiries, vendor questionnaires, or to request our Data Processing Agreement: [email protected]

To report a suspected security issue: [email protected]