Security & Compliance

Built for the money and the trust you're handling.

Fundrail administers real capital and sensitive investor information. Here is exactly how we protect it — the controls in place today and what is on the roadmap, written plainly.

Encrypted in transit & at restTwo-factor authenticationTamper-evident audit trailAutomated, tested backupsIsolated per organization

Built on trusted infrastructure

We stand on certified foundations.

The parts we don't build ourselves run on established, independently audited providers — specialists whose certifications you can rely on.

Runs card payments, subscriptions, and ACH bank transfers for capital calls. Card and bank details never touch our servers.

PCI DSS Level 1

Railway

Runs the Fundrail application itself — the servers that render every page and API request.

SOC 2 Type II

Hosts our database and encrypted document storage, in an isolated US region.

SOC 2 · ISO 27001

Fronts every request with TLS, DDoS protection, and a managed web firewall.

SOC 2 Type II

Anthropic

Powers the AI that reads your documents — on zero-retention terms, never trained on your data.

Zero-retention readySOC 2 Type II

Category	Our policy
Data security	Every connection encrypted with TLS Encrypted at rest, with AES-256-GCM on the most sensitive fields (e.g. bank account numbers) Social Security and tax ID numbers are never stored in our database Investor bank details for payments are tokenized by our processor, not kept by us
Access & authentication	Two-factor authentication (authenticator app) with backup recovery codes Role-based permissions with strict per-organization data isolation Hardened sessions; sign-in attempts rate-limited against brute force
Audit & integrity	Tamper-evident, hash-chained audit trail of every sign-in, money movement, and document access Altering any past record breaks the chain and is detectable Append-only financial ledger
Availability & backups	Automated database backups with a verified restore procedure Health monitoring and real-time alerts on high-signal security events Documented disaster-recovery process with defined recovery targets
Data retention	Financial and tax records retained per fund-administration norms (typically life of fund + 7 years) Audit logs kept at least two years Operational data on shorter schedules
Privacy & your data	Complete export of everything we hold on an investor, any time Erasure requests honored by anonymizing personal identifiers Financial records we're legally required to keep are preserved
AI & your data	AI only ever sees fund-level information — never investor SSNs, tax IDs, or bank details Your inputs are never used to train the model Auto-deleted within 30 days by default under our provider's standard terms Architected for zero data retention (ZDR): documents are sent inline through the API and never uploaded to a file store A person reviews every AI-drafted communication before it's sent
Payments & banking	Capital calls and distributions move through your own bank and established processors Funds settle to your accounts — never ours Fundrail facilitates the movement; it never holds your investors' money
Independent testing	Independent third-party penetration test planned as we scale Recurring security reviews, with remediation of any findings

Last reviewed August 2026. Security is ongoing work, and this page is kept current as our controls evolve. Questions, or want to review our security documentation? Email hello@fundrail.ai.