Last reviewed: 31 October 2026
Your portfolio contains information people trust you to protect. Here is how Fundeed handles access, connected data and AI processing, and where the boundaries are. We describe controls we can support with evidence, rather than implying a certification we do not hold.
Data protected in storage and transit
Fundeed’s application infrastructure is hosted on Microsoft Azure in West Europe. Production SQL database encryption is enabled. Private application-file storage encrypts blob data at rest, requires HTTPS with TLS 1.2 or later and disables public blob access. Integration credentials are encrypted in application storage. Authorised services still need to process readable information to provide the product; encryption does not mean no system or service provider can ever access it.
Access follows your organisation
Fundeed uses Auth0 for authentication. Application authorisation and database tenant controls scope access to the organisation a user is authorised to use. Workspace roles and membership checks restrict protected operations. These are shared-platform tenant controls, not a claim that every customer has a dedicated server or database.
Connect only what you choose
Google sign-in does not itself connect Gmail or Calendar. Both integrations require separate authorisation. Gmail uses read-only permission and cannot send, modify or delete messages through that permission. Calendar uses an events-specific permission for reading and managing events through scheduling features. You can disconnect a connection or revoke its grant in Google.
Gmail filtering before content import
Fundeed first reads message identifiers and sender metadata, then matches senders to your portfolio-company domains or recorded key-person email addresses. It retrieves matching message content and PDF attachments for import and interpretation. Unrelated identifiers and sender metadata can be checked in this process. A match establishes relevance, not sender authenticity, and the Google permission remains broader than the filter.
AI with reviewable source context
OpenAI processes relevant source text and workspace context to help propose portfolio updates, risk indicators and report drafts. AI can make mistakes: review outputs against their evidence before relying on them. Reporting narrative suggestions are editable before inclusion in a report. Scheduling features can change connected calendar events when instructed; this page does not imply that every AI action is read-only or that every action has a separate approval screen.
Diagnostics and retention with defined scope
Optional tenant diagnostics controls OpenAI response storage requested by the application; that storage is off unless diagnostics is enabled and a feature requests it. This is not zero-retention assurance for the provider. Browser product analytics starts opted out and session recording is disabled. Core operational and billing records are separate from optional analytics. Tagged raw uploads, email attachments and ingress payloads in production storage have a 90-day lifecycle threshold from last modification; other records and backups have separate lifecycles. Production SQL automated backups are configured for seven-day short-term retention.
Providers and processing locations
Azure supports the application infrastructure; Auth0 supports identity; OpenAI supports AI processing; Google supports optional connections. Email, billing, research, analytics and company-logo features use additional service providers listed in our Privacy Policy. The public website uses Framer, and enquiry follow-up uses Attio and lemlist. European application hosting does not mean all service-provider processing, support or backups remain in the EEA.
Security work and assurance
Our development process includes automated source, dependency and infrastructure security checks. Automated checks have scope limits and do not replace an independent penetration test. Fundeed does not claim SOC 2 or ISO 27001 certification, and certifications held by infrastructure providers do not extend automatically to our application. We do not present planned controls as already implemented.
Questions, deletion and security reports
Contact security@fundeed.io to report a suspected security issue or discuss a security questionnaire. Please avoid sending credentials or unnecessary customer data in an initial report. For privacy rights, retention or deletion requests, contact privacy@fundeed.io. Disconnecting an integration stops the connection; it does not automatically erase previously imported content.