How we handle the documents you send us.
Plain-English answers to the questions a procurement or compliance team will ask before signing the NDA. Read this alongside the mutual NDA on /nda-check or /evaluation — both reference the same controls described here.
Building toward SOC 2. Not yet certified.
We’re honest about where we are. Capital Refinery runs as a multi-tenant application with row-level security in the database, records where every number it serves came from (the document, page and cell), logs administrative actions, and encrypts traffic in transit. We’re not yet audited, and several SOC 2 controls are still being built, encryption at rest among them. We will not claim a certification, or a control, we don’t have.
For institutional buyers whose procurement requires a Type II report before submission: we maintain a security questionnaire we can sign and return to your security team within 5 business days, and we’ll commit to a timeline for the audit if it becomes the gating item on a deal you want to bring us. Email [email protected] and a member of the team will be in touch.
What happens to your file the moment you upload it.
TLS from your browser to our edge. Cloudflare is our front door: it terminates TLS, so requests, uploads included, pass through its network decrypted in transit before it forwards them to our server. Cloudflare is not used to store your files.
Your documents and our database sit on one dedicated server in Germany, in our own storage, not a third-party storage service. Encryption at rest is not yet in place: the server's disk is not volume-encrypted, and the database backups taken at each software release are not separately encrypted. The application encrypts stored integration credentials only. Volume and backup encryption are on our roadmap, and our security questionnaire gives the current state.
Numbers are read from your documents by deterministic parsers on that server. Where two candidate values conflict, a local model on the same server chooses among the named candidates; it never invents a number. Some written outputs (IC memo polish, decision briefs, narrative summaries and assistant phrasing) are drafted by a hosted model from Anthropic. To write them it receives deal details such as the deal name, sector, location, summary figures with their document references and covenant summaries; assistant questions are sent with email addresses and phone numbers masked. When you ask for property context, the collateral's street address is sent to US government geocoding and flood-map services.
There is no scheduled purge today and no self-service deletion. We keep your documents and the records derived from them. If you ask us to delete your data, we will confirm in writing what we removed and what remains in records the platform keeps permanently. A complete deletion path is on our roadmap. The database backups taken at each software release are kept and are not yet on a retention schedule.
Your data never trains a model. The local model's weights are released versions, not fine-tuned on customer data; this is in writing in section 12(b) of the NDA. Anthropic does not train its models on API traffic under its commercial terms.
Five. Named explicitly.
These are the outside services that receive customer data in production today, each with what it sees.
- 01 · Cloudflare
Edge proxy and DDoS protection. Cloudflare terminates TLS, so requests, uploads included, pass through its network decrypted in transit. It is not used to store your files.
- 02 · Contabo (hosting)
The dedicated server in Germany that runs the whole stack: application, storage, database, ingestion and the local model. No third-party storage and no SaaS database.
- 03 · Anthropic
The hosted model that drafts written outputs: IC memo polish, decision briefs, narrative summaries and assistant phrasing. It receives the deal details needed to write them, as described under Processing. US-based.
- 04 · Resend
Transactional email. Resend sees the email body and any attachments, which can contain deal data. If your procurement requires delivery through your own mail relay, email [email protected] and we will configure it.
- 05 · Stripe
Billing only. Stripe sees the account name, email address and billing identifiers, never your documents.
Public data lookups (US government geocoding and flood maps) receive a property address only when you request property context. The full register, including services the software can use but that are switched off in production today, is part of the security package available on request.
72-hour notification commitment.
In the event of any security incident affecting your data, the affected customer is notified within 72 hours via the email on the original NDA, and again via a phone call to the signer listed on the engagement. We commit to:
- Disclose what we know within 72 hours of detection, even if the investigation is incomplete.
- Provide a written postmortem within 14 days, including root cause, scope of exposure, and remediation timeline.
- Honor your right to terminate the engagement. We will confirm in writing what we deleted and what remains.
Report a suspected vulnerability or incident to [email protected]. We acknowledge within 24 hours and respond with a triage update within 72.
- Train any model — ours or a third party’s — on your data.
- Share your documents with anyone other than our team and the services named on this page.
- Ignore a deletion request. We act on it and confirm in writing what we removed and what remains.
- Use your data as a sales reference, case study, or marketing artifact — even anonymized — without written consent.
- Add a service that receives your data without telling you first and giving you the chance to object.
If your team needs the full security package — the sub-processor register, hosting details, the current state of encryption and retention, and custom DPA redlines — email [email protected] with the questionnaire your firm uses. We respond within 5 business days.
For redlines specifically on the engagement NDA, email [email protected]. We work in track-changes Word documents; we sign DocuSign, Adobe Sign, or scan-and-PDF — whatever your team uses.