The cargo is precious.
We treat it that way.
You carry client books, investor identities, and money in motion. Here is exactly how all of it is protected, written in plain words your IT reviewer can check.
Your data stays yours alone
Every row in every table belongs to your workspace, and the database itself enforces the wall, not just the application code. No other customer can ever see your records.
Encryption where it counts
Everything travels encrypted. Connection tokens, sign-in secrets, and the tax, ID, and bank account numbers investors enter in their profiles are encrypted again at the application layer on top of encrypted storage.
Real two-step sign-in
Authenticator apps, text codes, and email codes, with single-use backup codes for recovery and an admin reset as the fallback. The investor portal requires two-step sign-in, no exceptions.
Passwords checked against known breaches
A 12-character password policy enforced on our servers, and every new password is checked against the public breach registry in a way that never sends the password itself anywhere.
Verified connections
Our Microsoft connection is from a verified publisher (TenthAvenue Labs Inc.). Your calendar and your mailbox are separate permissions: scheduling asks only for your calendar, and your mail is read only if you connect your mailbox to the Inbox yourself. Every member connects and disconnects their own accounts, and access can be revoked any time.
A record of sensitive actions
Invitations, role changes, sign-in resets, domain changes, and identity lookups all land in an audit log.
Have a security questionnaire?
Send it over. We answer them directly, with the engineers who built the controls in the loop.
Contact us