Trust center
The data controls that are in the product today.
Fund scoping
Each fund is its own workspace inside a firm. Each query on deal data includes the fund of the signed-in member or the API key. A member of one fund cannot read or change the deals of another fund.
Audit log
The product records actions on deals (for example, a change of pipeline stage) with the member, the action and the time. The log is kept for each fund.
Data retention
An admin can set a retention period from 30 to 3650 days. Only archived deals that are older than the period are eligible for deletion. A live deal is never eligible.
Encryption of connector tokens
OAuth tokens for connected tools are encrypted with AES-256-GCM before we store them.
API key scopes
An API key can have scopes: read deals, write deals, or manage webhooks. A key with a scope is refused for other actions. A key can have an expiry date. We keep only a hash of each key.
Certifications
What we have and do not have.
We do not have a third-party certification at this time. For a security questionnaire, email security@ideapulley.com.
For infrastructure and disclosure, see the security page.
