Security & data

Workspace isolation

• Every API request is gated on workspace membership (or an explicit company/LP grant).
• Clients never write to the database. Mutations go through the API with membership checks.
• Identifiable workspace content is not used to train models shared across customers or made public. You may object to anonymized/aggregated improvement use as described in the Privacy Policy.
• MCP tokens, when used, are bound to a single workspace.

Where data lives

Primary storage (database, files, API compute) is in the EU on Google Cloud europe-north1 by default. Transcription and analysis are performed by subprocessors (currently OpenAI Whisper and Google Gemini) only to deliver the feature you request. Those providers are not guaranteed to process data in the EU. The full subprocessor table is in the Privacy Policy, section 4.

Your controls

• Organization admins can schedule deletion of the organization (24-hour grace) or an extra workspace (4-hour grace) under Settings → Account.
• Analyses and meetings can be org-shared, private, or restricted to named people.
• Founders and co-investors are invited per company, with section-level visibility.
• You can export a company’s current picture (description, analysis, KPIs, scorecard, contacts) from the company page. A full workspace export is available on request — see Settings → Account or email marcus@vcfieldassistant.com.

DPA and subprocessors

A data processing agreement and the current subprocessor list are available on request at marcus@vcfieldassistant.com. Subprocessors that process personal data outside the EEA are covered by SCCs where applicable, as described in the Privacy Policy.

Report a concern

Email marcus@vcfieldassistant.com. We do not currently publish a bug-bounty program or an incident SLA on this page.