Security Policy

1. Authentication

Sign-in is handled by Supabase Auth, a dedicated authentication provider - Capmatter never stores your password directly. Sessions are managed via secure, SameSite=Lax cookies scoped to our domain, enforced over HTTPS in production. One sign-in works across the marketing website and the Capmatter app, since both share the same authentication provider and cookie domain.

2. Data isolation

Your data is protected by database-level row security policies, not just application-layer checks - every query, whether it comes from our own application code or a direct API call, is filtered by the database itself to only the rows you're authorized to see or modify. Cross-tenant access (one company or user reading or writing another's data) is enforced at this layer, not left to application code alone.

3. The share ledger - write-once, tamper-evident

Capmatter's cap table is built on an append-only ledger: ownership records cannot be edited or deleted after the fact by any user, including company owners - only voided with a recorded reason, preserving the original entry. Bulk ownership changes (corporate actions, buyback and tender settlements) are written to the ledger in a single all-or-nothing insert. Sensitive correction operations (voiding a ledger entry or ESOP grant) run through privileged, server-side-only database functions that independently re-verify ownership on every call, so a compromised client or forged request cannot bypass authorization by calling the underlying operation directly.

4. Server-side enforcement

Every request that changes data is independently authenticated and authorized on our servers - client-side checks (hiding a button, redirecting a page) are a UX convenience only, never the actual security boundary. This applies uniformly to company workspaces, the employee and investor portal, billing, and administrative tools alike. The portal is served by database functions that return only the grants and holdings recorded against the signed-in user's own confirmed email.

5. Input validation

Every write path validates its input on our servers, independent of whatever validation the browser already performed - request bodies are checked against strict schemas (type, format, length, and allowed-value checks) before anything is written, and rejected with a clear error otherwise. This protects against malformed, malicious, or unexpectedly large input arriving from any source, not just our own web app.

6. Rate limiting and abuse prevention

Registration, contact, payment, import, and export endpoints are rate-limited, and sign-in attempts are rate-limited by our authentication provider, to limit the impact of automated abuse, credential-stuffing attempts, or a compromised account.

7. Audit logging

Financial mutations (shareholder, funding round, ESOP, and share-class changes) and administrative actions (account restrictions, feature-flag changes) are recorded in an append-only audit trail - who did what, when, and what the record looked like before and after - independent of the data itself, so a change can always be traced back to who made it.

8. Encryption

• In transit: all traffic between your browser and Capmatter, and between our services and our database, is encrypted via HTTPS/TLS.
• At rest: data is stored with our infrastructure provider's standard at-rest encryption.

9. Sessions and sign-in options

• Idle sign-out: a workspace owner can have people signed out after 15 minutes to 8 hours without activity, with a warning first.
• Sign out everywhere: anyone can sign out of every browser and device at once from Settings.
• Single sign-on: companies whose identity provider supports SAML 2.0 can ask us to set up single sign-on for their email domain.

10. Where Capmatter runs

The website and the app are hosted on Vercel. The database and sign-in are provided by Supabase (PostgreSQL). Our sub-processors are listed in our Data Processing & Compliance page.

11. Approvals and maker-checker

Companies can require two-person approval for equity actions such as plans, corporate actions, valuation reports, and liquidity programs. When it is switched on, the database itself refuses an approval from the person who submitted the item, and records who submitted and who approved it and when. Each record type can only be changed by members whose role carries the matching permission.

12. Account export and deletion

Account deletion is requested from Privacy & data in the Capmatter app and is carried out only after we confirm your identity by email, so a session left signed in on someone else's device cannot delete your account on its own. See our Data Retention Policy for what happens to your data during and after this process.

13. Reporting a security issue

If you believe you've found a security vulnerability in Capmatter, please report it to us directly and privately rather than disclosing it publicly, so we can investigate and fix it before it's exploited. We ask that you avoid accessing, modifying, or deleting data that isn't your own while investigating.