Security
Your fund’s numbers, locked down where it counts
The interesting question for fund administration is not whether the login page is secure. It is whether a number can change without anyone knowing. Here is exactly how FundFlow answers that, and what it does not claim.
No credit card. Nothing is charged until your first 30 days are over.
Separation between organisations
Every table in the database has row-level security, and access is granted through your membership of an organisation. It is not a filter the application adds to its queries: a query that tried to read another organisation’s fund returns nothing, because the database refuses to return it.
- Row-level security on every table in both schemas
- Access derived from organisation membership, checked in the database
- Money-moving operations assert your membership before they run
Months that cannot change behind your back
A locked month is immutable at the database level, not merely hidden from the interface. Corrections go through an administrator reopening it with a written reason, or through the current month: the way a fund administrator would work anyway.
- Locked periods rejected on write by the database itself
- Reopening is administrator-only and requires a written reason
- Exactly one open month per fund, so there is no ambiguity about where you are working
- Optional two-person NAV confirmation
A trail of what happened
An audit trigger is attached to every business table in both schemas, and it writes to a log that no application user can read or alter. On top of that, the change history for each participant is surfaced in the app, searchable and filterable.
- Audit trigger on every business table
- The audit log itself is not readable or writable through the application
- Participant history visible in the app, searchable and paged
- Every statement send recorded per recipient with its status
Roles, enforced below the interface
Four roles: administrator, editor, viewer and reviewer. What each can do is enforced by database policy, not by which buttons the interface happens to render: so hiding a button is never the only thing standing between a viewer and a write.
- Administrator, editor, viewer and reviewer
- Everyone reads; editors write bookkeeping; administrators change configuration
- Force-locking a month with a failing check is administrator-only and deliberately awkward
Accounts and sign-in
Sign-in is email and password, with the address verified by a one-time code during signup and a recovery flow for a forgotten password. Passwords are subject to strength rules. There is no two-factor authentication yet: we would rather say so than let a security page imply otherwise.
- Email and password, with a verified email address
- Password strength rules on signup and reset
- Password recovery by one-time code
- No two-factor authentication yet
What we do not claim
A security page is worth reading only if it is also willing to say what is not true.
- We hold no SOC 2, ISO 27001 or comparable certification, and we do not display badges for ones we do not have.
- We make no uptime or service-level promise on this page.
- There is no two-factor authentication and no single sign-on today.
- FundFlow is administration software. It is not a regulatory filing tool and it does not make your fund compliant with anything by itself.
Who processes what
FundFlow runs on four services. They are listed here, and in the privacy statement, because you should not have to ask.
Supabase
The database that holds your fund data, and the authentication service behind sign-in.
Cloudflare
Serves the application itself.
Resend
Delivers the emails and statements you send to participants.
Cloudflare Zaraz and Google Analytics
Measures how the public pages are used, on the public pages only and only after you accept it. It never receives fund data: identifiers are stripped from page addresses before anything is sent.
Questions a page cannot answer
If you need specifics for a due-diligence questionnaire or a data-processing agreement, write to us and you will get a straight answer from a person.
No credit card. Nothing is charged until your first 30 days are over.