Security and privacy
Access
Every desk user signs in individually with a role; two-factor sign-in can be required; one live session per person; admin powers can be limited to known networks. Outside parties see only their own deals through a separate portal.
Data protection
Data is held by Supabase (database) and served by Vercel, encrypted in transit. Access rules are enforced by the database itself and tested automatically before every release. Exports are gated, watermarked, fingerprinted and logged.
Records
An append-only, hash-chained access log; nightly encrypted backups, tested by a weekly restore drill (write-once storage once the backup bucket is set up); a daily communications journal kept six years; legal holds.
Privacy
We collect the contact, company and financial information people enter on our forms and use it to evaluate and discuss financings; full detail is in the privacy notice. Requests to see or delete personal data are answered within 45 days, except where securities recordkeeping rules require us to keep it. Every email has a one-click unsubscribe. We do not sell data.
Reporting a security problem
If you find a vulnerability, email security@securitief.com with the steps to reproduce it. We reply within two business days, keep you informed while we fix it, and credit you if you wish. Please test only against your own account, don’t access other people’s data, don’t degrade the service and don’t run automated scanners against production. We will not pursue legal action for research that follows these rules. Machine-readable contact: security.txt.
Full answers for vendor security reviews: security overview. Draft terms of use.
Questions: use the contact on our plans page.