Skip to content
Zirp
Menu

Security

The public site collects an enquiry. The desk is invite-only.

This page is the short version Legal and InfoSec ask for before a first call. A signed pilot sits under a separate agreement and an NDA. A full SOC 2 is sequenced after that first signature — not before it.

  1. What the website stores

    The contact form stores your name, work email, company, role, an optional fund-count range, markets of interest, your message, and routine request metadata (time, user agent, referrer). Do not send personal data of underlying investors through this form. We do not run advertising pixels.

  2. Where it lives

    Enquiries are written to our hosted database (Supabase) with row-level security and no anonymous access, and a copy is emailed to us (Resend). The public site is served from Vercel. Keys for those writes are server-only.

  3. What never sits on the marketing site

    Vertex, Exa, and other pipeline credentials live on the worker that runs ingest, matching, and digest jobs. They are not in the public frontend and they are not on the dashboard runtime except an operator re-run key. The marketing app does not import the pipeline.

  4. The desk, once you are a seat

    Access is invite-only magic link. Organization is the firm; a workspace is a market seat. Regulator rows are shared reference data. Funds, matches, and memos stay on the workspace. Reviewers sign matches; sending a memo goes to owner and reviewer seats, not an open distribution list.

  5. Pilots and internal files

    Internal holdings, IM caps, and sub-advisory terms are not collected here. They only enter after a signed pilot, on the same overlay path the desk already uses for a labelled demo file. NDA first. SOC 2 after the first signed pilot.

  6. Subprocessors (current)

    Vercel (site), Supabase (database and auth), Resend (email), Trigger.dev (pipeline orchestration), Google Cloud Vertex AI (extraction and matching on the worker). The list on a paid engagement will be in the agreement.

Security questions are welcome on the first call.

If you need a one-pager for vendor risk, say so in the form. Let’s talk.

Let's talk