Security at FundRoom AI

Your fund data deserves enterprise-grade protection. Here's how we keep it safe.

Encryption

AES-256-GCM encryption for all sensitive data (SSN, EIN, wire details, signatures)
TLS 1.3 for all data in transit
Encryption keys managed via environment variables, never committed to source
Per-organization encryption key derivation using HKDF

Authentication & Authorization

NextAuth with email/password (bcrypt, 12 salt rounds) and Google OAuth
Edge-level JWT validation on ALL API routes via proxy middleware
5-layer defense-in-depth: edge auth → admin auth → RBAC → domain middleware → business logic
Rate limiting: blanket 200/min + per-route tiers (auth 10/hr, strict 3/hr, MFA 5/15min)

Multi-Tenant Isolation

Every database table includes org_id — every query is scoped by organization
RBAC: Owner, Super Admin, Admin, Manager, Member roles with per-action enforcement
Cross-tenant data access is architecturally impossible via query-level isolation
CRM contacts, documents, funds, and investors are all team-scoped

Compliance

SEC Rule 506(b) and 506(c) compliance built into investor onboarding
ESIGN Act and UETA compliant native e-signature system
SHA-256 hash-chained immutable audit logs for regulatory examination
Form D data export with all required SEC fields
Accreditation verification tracking with expiration management

Infrastructure

Deployed on Vercel with automatic DDoS protection
PostgreSQL on Supabase with connection pooling and health monitoring
Content Security Policy, HSTS (2-year preload), X-Frame-Options headers
CSRF protection with origin validation + custom header fallback
Bot protection via Vercel Bot ID

Incident Response

Rollbar error monitoring with PagerDuty alerting for critical failures
Security incident fingerprinting for auth brute force and unusual access
Anomaly detection on login patterns and data access
Structured JSON logging with request tracing for forensic analysis

Report a Vulnerability

If you discover a security vulnerability, please report it responsibly.

security@fundroom.ai