Security & Compliance

Data Encryption

Fund Flow applies encryption at every layer of the data lifecycle.

Encryption at Rest

All data stored in Fund Flow databases is encrypted using AES-256-GCM, the same standard used by financial institutions and government agencies. This includes:

• Investor personal and financial records
• Deal and loan data
• Documents and file attachments
• AI-generated content and activity logs

Database volumes are encrypted at the infrastructure level. Even if physical storage media were to be removed, the data would be unreadable without the encryption keys.

Encryption in Transit

All data transmitted between your browser (or mobile device) and Fund Flow servers is protected by TLS 1.3. Connections using older TLS versions (1.0, 1.1) or weak cipher suites are rejected. Fund Flow enforces HTTPS on all endpoints — there is no unencrypted fallback.

Database Security

Row-Level Security (RLS)

Fund Flow uses PostgreSQL's Row-Level Security to enforce data isolation at the database level. Every query is automatically scoped to the authenticated organization. A query from Organization A cannot, even accidentally, return data belonging to Organization B. RLS is enforced by the database engine itself, not application code, making it immune to application-layer bugs that might bypass access checks.

Admin vs. Standard Database Access

Writes to audit and AI activity tables require an elevated AdminDatabase connection. Standard queries use the Database or Transaction type with RLS enforced. This separation means that even if application code is compromised, it cannot write to sensitive audit tables without the elevated credential.

Authentication & Access Control

Supabase Auth with Two-Factor Authentication (2FA)

Fund Flow uses Supabase Auth as its identity provider. All passwords are hashed with bcrypt — plain-text passwords are never stored. Two-factor authentication (2FA) using a TOTP authenticator app (Google Authenticator, Authy, 1Password, etc.) is available for all accounts and strongly recommended.

To enable 2FA, go to Profile > Security > Two-Factor Authentication.

Role-Based Access Control (RBAC)

Fund Flow enforces a five-tier RBAC model. Every user action is checked against the user's role before execution.

Role changes take effect on the next login session for the affected user.

Document Security

Document Encryption

All uploaded documents (PDFs, DOCX, images) are encrypted at rest using the same AES-256-GCM standard as database records. Documents are stored in isolated, access-controlled buckets. Pre-signed URLs with short expiry times are used for document downloads — the URL itself cannot be shared and used indefinitely.

E-Signature Audit Trails

Every e-signature event is logged with:

• Timestamp — UTC timestamp of when the action occurred
• IP address — The signer's originating IP address
• Signer identity — Email address and session token
• Document hash — A SHA-256 hash of the document at the time of signing, confirming the document was not modified after signing

Completed e-signature records are immutable. The audit trail is stored separately from the document itself to ensure it remains intact even if the document is modified.

AI Data Privacy

Your Data is Not Used for Training

Data you enter into Fund Flow — contacts, deals, documents, communications — is never used to train shared or third-party AI models. AI processing occurs within your organization's isolated context. The AI has access only to the data you have explicitly linked to a task or conversation.

AI Activity Logging

All AI agent actions are logged in the Activity Log accessible at AI Command > Activity Log. Logs include what the AI was asked to do, what it did, who approved it, and when. Logs are retained for a minimum of 12 months.

Regulatory Compliance

Regulation D (Reg D)

Fund Flow is built to support workflows commonly used in Regulation D (Rule 506(b) and 506(c)) private securities offerings:

• Investor accreditation tracking — Record and store accreditation documentation for each investor
• Document audit trails — Track when documents were viewed, signed, and by whom
• Investor-only access — Investor portal access is isolated from public-facing content

GDPR & Data Privacy

For organizations with European investors or operations:

• Data access requests — Fund Flow can provide an export of all personal data held for a given individual upon request.
• Right to erasure — Personal data can be deleted upon verified request. Financial records required for legal retention may be anonymized rather than deleted.
• Data processing agreements (DPAs) — Available upon request for enterprise customers. Contact legal@fundflow.com.
• Data residency — Data is processed and stored in the United States. International data transfers are governed by Standard Contractual Clauses (SCCs) where applicable.

Backups & Business Continuity

Automated Daily Backups

Database backups run automatically every day. Backups are:

• Encrypted with AES-256 before storage
• Stored in geographically separate regions from the primary database
• Retained for 30 days on standard plans and 90 days on enterprise plans

Point-in-time recovery is available for databases — contact support to initiate a restore from a specific timestamp.

Uptime & Availability

Fund Flow targets 99.9% uptime for the application layer. Planned maintenance is announced via the status page at status.fundflow.com with at least 48 hours notice. Emergency maintenance is communicated via in-app banners and email.

Session Security

Session Expiry

Authenticated sessions have an idle timeout. Sessions that are inactive for an extended period are automatically invalidated, requiring re-authentication. This protects accounts left open on shared or unattended devices.

Active Session Management

Users can view and terminate active sessions from Profile > Security > Active Sessions. If you see a session from an unrecognized device or location, terminate it immediately and change your password.

Login Attempt Rate Limiting

Fund Flow applies rate limiting to login attempts. Repeated failed attempts from the same IP address result in a temporary lockout to prevent brute-force attacks.

Incident Response

Security Incident Protocol

If Fund Flow detects or is notified of a security incident affecting customer data:

1. The incident is triaged and contained within four hours of discovery.
2. Affected customers are notified within 72 hours, consistent with GDPR breach notification requirements.
3. A post-incident report is made available to affected customers upon request.
4. Notifications include: what data was affected, what steps Fund Flow has taken, and what customers should do.

Reporting a Security Vulnerability

If you discover a potential security vulnerability in Fund Flow, please report it responsibly to security@fundflow.com. Do not publish vulnerability details publicly before contacting us. Fund Flow reviews all reported vulnerabilities promptly and credits researchers who follow responsible disclosure.