Compliance & Governance

How the platform is governed — stated plainly, without certification claims we have not earned.

Data protection

Built DPDP-aware and GDPR-principled in design intent, not a certified standard: purpose limitation guides what we collect, and our database sits in India-region residency (AWS ap-south-1 via Supabase). Being honest about the gaps: there is no automated consent-logging mechanism today, and data-subject deletion is a manual process (email privacy@capitalsync.net), not yet a self-service flow — see our Privacy Policy for the current, real state of both.

Access control

Row-level security on tenant data and role-based portal access are live today. Structured audit logging currently covers cap table changes (shareholders, share certificates, funding rounds, cap tables, RBF applications); logging of authentication, payment, and document-access events is on our roadmap, not yet built — stated plainly rather than implied.

Payments compliance

All card/UPI data is handled by PCI-DSS compliant gateways (Razorpay, Stripe). CapitalSync never stores card numbers. Webhooks are signature-verified and fail closed.

AI governance

Agents operate with human-approval gates on outward actions (payments, signatures, investor contact) and budget caps enforced in code. Activity logging exists per-agent-run; a unified cross-agent audit view for external review is not yet built.

Regulatory posture

We monitor RBI, SEBI and MCA frameworks relevant to our customers and surface obligations inside the product. CapitalSync itself is a software provider, not a regulated financial intermediary.

Reporting an issue

Security or compliance concerns: contact@capitalsync.net — we acknowledge within 2 business days.