Trust Center

Security and compliance,documented and verifiable

Private equity runs on confidential information. Deal documents, fund data, and portfolio company records are among the most sensitive assets a firm handles, and protecting them is the foundation Fundrev is built on. Use this Trust Center to review our security posture and request access to our security documentation.

Browse the documents
Independently audited
SOC 2 Type 1 and Type 2, across all five trust services criteria.
Tenant isolation
Each firm’s data sits in its own database — not a shared table separated by an identifier column.
Hosting
Amazon Web Services, United States. No other cloud is in the architecture.
Your data and AI
Never used to train or fine-tune any model, ours or a third party’s.

Standards & assurance

What has been verified, and by whom

Audited means an independent firm examined our controls and issued an opinion. Aligned means we build and operate to the standard, and nobody has certified it. We do not blur the two.

  • SOC 2 Type 1Audited

    An independent auditor's opinion on the design of our controls at a point in time, across all five trust services criteria.

  • SOC 2 Type 2Audited

    An independent auditor's opinion on how effectively those controls operated over a period — the stronger of the two reports.

  • GDPRAligned

    Collection, processing and storage of customer data follow EU GDPR practices, with a record of processing activities and impact assessments maintained.

  • CCPAAligned

    Data handling is aligned to the privacy principles set out in the CCPA: notice at collection, deletion on request, and no sale of personal information.

  • EU AI ActAligned

    Fundrev is a deployer of third-party models, not a provider of one. Every AI feature is registered, advisory and human-in-the-loop, and no customer data trains or fine-tunes any model.

  • OWASP Top 10Aligned

    Built and reviewed against the OWASP Top 10 (2021). All ten risk categories are mapped to operating controls in our compliance platform, from parameterised database access to append-only audit logging.

  • VAPTAudited

    An external organisation tests the web application for vulnerabilities. Findings are classified by severity and closed on their recommendation; the report is available on request.

Documents

44 available under NDA

Each document below was in scope for our SOC 2 examination. Request the one you need and, once approved, a copy watermarked with your name is emailed to you — you do not need an account with us.

Reports

Corporate Security

Data Security

Access Control

Infrastructure

App Security

Product Security

Endpoint Security

Legal & Privacy

Subprocessors

The third parties we engage to process customer data on our behalf. Systems you connect yourself — your CRM, document store, or warehouse — remain yours and are not listed here.

CompanyPurposeLocationAdditional details
Amazon Web Services (AWS)Cloud infrastructureUnited StatesThe entire production platform — Kubernetes compute, object storage, databases, networking, CDN and secrets management.Privacy portal: aws.amazon.com/privacy
Anthropic (via Amazon Bedrock)AI model inferenceUnited StatesLanguage model inference for AI features, served inside our own AWS account. Customer data is never used to train models.Privacy portal: www.anthropic.com/legal/privacy
Amazon TextractDocument extractionUnited StatesText extraction from scanned and image-based documents.Privacy portal: aws.amazon.com/privacy
ZeptoMail (Zoho)Transactional emailIndiaInvitations, notifications and account mail. Recipient name, address and message body.Privacy portal: www.zoho.com/privacy.html
MicrosoftIdentity federationCustomer's own tenantSign-in for customers using Microsoft Entra ID, and the Graph authorisation a customer grants when connecting their own SharePoint or OneDrive.Privacy portal: www.microsoft.com/en-us/privacy/privacystatement
GoogleIdentity federationUnited StatesSign-in for users who choose Google as their identity provider.Privacy portal: policies.google.com/privacy
GitHubSource code managementUnited StatesVersion control, code review and CI/CD. Customer data is never stored in source control.Privacy portal: docs.github.com/en/site-policy/privacy-policies
Microsoft OneDriveInternal file storageUnited StatesInternal document storage and sharing for the Fundrev team.Privacy portal: www.microsoft.com/en-us/privacy/privacystatement
Microsoft TeamsCollaborationUnited StatesInternal messaging, team communication and video calls.Privacy portal: www.microsoft.com/en-us/privacy/privacystatement
NotionKnowledge managementUnited StatesInternal documentation, procedures and process notes.Privacy portal: www.notion.so/Privacy-Policy
FigmaDesignUnited StatesInterface design, prototyping and design system maintenance.Privacy portal: www.figma.com/legal/privacy
CalendlySchedulingUnited StatesBooking meetings with external and internal stakeholders.Privacy portal: calendly.com/legal/privacy-notice
LinkedInOutreach and recruitingUnited StatesOutreach, hiring and professional communication.Privacy portal: www.linkedin.com/legal/privacy-policy

We notify customers of a change to this list under the terms of the Data Processing Agreement.

Questions, or a security concern

Security questionnaires, diligence requests, and vulnerability reports all reach the same team.

Documents & questionnaires

Request through our compliance portal

Report a vulnerability

admin@fundrev.ai