Capalsan
Security and data handling
Workspace confidentiality
Investment records are protected by organization-scoped database access policies. Team roles determine write, approval and administration permissions.
Private documents
Documents are stored in a private bucket. Authorized users receive expiring signed download URLs; public document links are not used.
AI provider handling
Selected extracted passages are sent to the configured AI service for analysis. Provider processing and retention terms must be assessed before confidential data is submitted. We do not claim a completed independent assessment or zero-retention guarantee.
Encryption and access
Cloud services provide transport security and managed storage. Administrators should review contractual infrastructure details and their own access procedures before production use.
Audit and retention
Record changes, workspace creation, invitations and role changes create audit events. Administrators can delete authorized records and documents. Backup retention and contractual deletion timelines require confirmation.
Deployment and certifications
The current application uses Lovable Cloud. Dedicated VPC, on-premise hosting, SOC 2 certification, GDPR compliance, DORA readiness and independent audit completion are not verified or offered as established facts.