Security
Not a checkbox. A structure.
A cap table is the record of who owns the company. CapDaddy protects it in the database and the cryptography, not in a policy document: the guarantees below are properties of how the product is built, and you can check every one of them from inside your own account.
How the record is protected
Append-only ledger, one hash chain per organization
Every cap-table event is appended, never edited. The database itself rejects updates and deletes on the ledger and the audit log, so a correction has to be a new, signed event (an amendment or a retraction) that stays in the history. Each event links to the one before it by hash, giving one continuous chain per organization: a rewritten or removed event breaks the chain, visibly.
Row-level security, enforced per organization
Tenant isolation lives in Postgres, not in application code that could forget a WHERE clause. Row-level security is enabled AND forced on every organization-scoped table, the application connects as a role that cannot bypass it, and the organization context is set inside the transaction. With no context, the query returns nothing: it fails closed.
Passkeys confirm the changes that matter
Sign-in is Google SSO, and changes to your equity records are confirmed with a device-bound WebAuthn passkey. There is no password to phish, reuse, or leak, and a stolen session alone cannot move shares.
Magic links that a scanner cannot spend
Director, stockholder, and holder links are single-use and time-limited, and they are consumed on POST, never on GET, so an email scanner or a link preview cannot silently burn one. Only a SHA-256 hash of each token is stored, so the database never holds a working link.
Documents are the authority, with timestamped evidence
No ledger entry exists without executed paper behind it. Final documents are hashed, signature evidence is captured with the signer's link audit trail, and packets are anchored with RFC 3161 trusted timestamps from an independent authority, so the date on the evidence is not just our word.
Exact numbers, and your data on the way out
Share counts are exact integers and money is exact decimal arithmetic: no floating-point drift can enter the record. Your full ledger exports at any time (Open Cap Format JSON, Excel, PDF), on the free plan included, so leaving is never held over you.
In transit and in the browser
- HTTPS everywhere, with HSTS preloading, so a first request is never downgraded.
- A content security policy with no unsafe script evaluation and a tight allowlist for form targets.
- Framing denied outright, so the product cannot be embedded and clickjacked.
- No referrer leakage, and MIME sniffing turned off.
- Camera, microphone, geolocation, and browser payment APIs denied by policy.
- Bot protection on the public forms that send email, with per-network rate limits.
Subprocessors
These are the third parties that can hold or see customer data, and what each one does. The same list appears in the Privacy Policy. Customer data is hosted in the United States.
| Provider | What it does |
|---|---|
| Railway | Application hosting and the managed Postgres database that holds the ledger. United States regions. |
| Stripe | Subscription billing, checkout, and the customer billing portal. Card details go to Stripe and are never stored here. |
| Sign-in with Google (OAuth), and Gmail or Google Workspace as an alternative delivery path for product email. | |
| Resend | Delivery of product email: invitations, magic links, reminders, confirmations, and operational notices. |
| Cloudflare | Turnstile bot protection on public forms, and RUM/Web Analytics performance metrics on proxied pages. |
| Timestamp authorities | RFC 3161 trusted timestamps that anchor document and audit evidence (public authorities, or a pinned endpoint). |
| Observability and logging providers | Collection of error reports and operational logs, where the deployment configures a sink. |
Report a vulnerability
Send anything you find to [email protected]. Include what you did, what you saw, and how we can reproduce it. We answer, we fix, and we credit you if you want the credit. Please do not run tests that degrade the service or touch another company's data; use your own account.
The same address is published at /.well-known/security.txt.
Certification status
CapDaddy is not yet SOC 2 audited. The controls above are structural and verifiable in the product.
We would rather say that plainly than imply an audit we have not had. If your diligence process needs a questionnaire answered, write to [email protected] and we will answer it directly.
Or read the Privacy Policy and the Terms.