Skip to content
RoundReady

Security

This page describes what the application code does today. It is not a certification and it does not name a legal entity.

Data handling

  • Accounts are created with Supabase Auth. Passwords are stored by that provider, not in application tables.
  • Data rooms, checklist mappings, financial figures you enter, and pitch inputs are rows in Supabase Postgres.
  • Uploaded files go to the Supabase Storage bucket the API is configured to use.
  • The site (Vercel) and API (Railway) are served over TLS, so traffic is encrypted in transit.
  • Supabase encrypts customer data at rest with AES-256. RoundReady does not add a separate application-layer encryption key, and this is not end-to-end encryption. The product and its subprocessors can read file contents to store, classify, and share them.
  • When AI classification or extraction is enabled for an account, document text is sent to Anthropic for that request.
  • Card numbers are handled by Stripe. The app stores a Stripe customer id, not a full card number.
  • You can delete rooms, files, and share links in the product. Account deletion is described in Settings.

Subprocessors

These are the providers the codebase is written to call. The Privacy Policy describes the same list.

  • Vercel — frontend hosting
  • Railway — API hosting
  • Supabase — authentication, Postgres, and file storage
  • Stripe — subscription checkout and the customer billing portal
  • Resend — transactional email when that integration is configured
  • Anthropic — optional document classification and extraction

Share-link tokens

  • Creating a link generates a token of 12 hexadecimal characters from a random UUID (about 48 bits). The token is the secret. Anyone who has the link can open that view. Investors do not need an account.
  • The API looks the token up exactly. It responds 404 when the token is unknown, revoked, or past its expiry.
  • The room owner chooses whether the link shows the readiness score, missing critical documents, a subset of categories, and whether downloads are enabled. Downloads stay off unless that flag is set.
  • A successful open increments the link's view count and last-accessed time.
  • The public sample at /s/sample is not a database row. The page renders fixed fictional data in the browser and does not count a view.

Contact

Legal entity: not published.

Security contact: not published. The owner still needs to add the legal entity and a monitored email. This page does not offer a security inbox until then.

Privacy questions are described on the Privacy Policy. Terms are on the Terms of Service.