Trust · Security
Security and
confidentiality.
You're uploading documents that are often pre-funding, often confidential, sometimes containing material non-public information. Here's what we do — and don't do — with them.
Data handling
Your private workspace history.
Account-owned decks and reports remain in your workspace. Unclaimed uploads expire after 24 hours. File access is checked against your verified account or an authorized staff role.
Your uploads are never used for training.
We don't train our own models, and model training is switched off on the AI accounts that read your decks. Your deck is used only to produce your reports.
Where your data lives.
Public services use HTTPS. Workspace data and uploads use Convex in Ireland; analysis runs and results use our processing server in New York (US). Stripe handles card details.
Checked access.
Every request for a deck or report is checked against your verified account. Only you and authorized Early Capital AI staff can open your decks and reports, and staff open them for support only.
No introductions, no syndication, no brokerage.
We don't connect founders to investors, syndicate deals, or share decks with anyone. The report stays between you and us.
Compliance status
SOC 2 Type II
PlannedTarget Q1 2027
GDPR
ReadyData export and deletion via support
Data residency
EU and USWorkspace data in Ireland (EU); analysis server in New York (US)
DPA on request
ReadyEmail assistant@earlycapitalgroup.com
Responsible disclosure
Found a vulnerability? We're grateful. Email assistant@earlycapitalgroup.com with details. We respond within twenty-four hours and credit researchers on our security page (with permission).