How CarveOutIQ protects deal data.

Where deal data is stored

In a managed Postgres database hosted by Supabase in the London region (AWS eu-west-2), so it stays in the UK.

• Encrypted at rest (AES-256) and in transit (TLS on every connection).
• The hosting provider holds a SOC 2 Type 2 report. CarveOutIQ does not yet hold its own certification.
• The web application is served by Vercel. Calculations run in the user's browser, and saves go from the browser straight to the London database.

Who can see a deal

Only the user who created it. The database enforces this, not just the app.

• Accounts: CarveOutIQ creates every account. There is no public sign-up.
• Access: every deal carries its owner's ID, and row-level security lets only that owner read, save or delete it.
• Sharing: there is no in-app sharing between users or firms. A deal leaves the platform only when its owner exports the IC pack (PDF) or the deal data.
• Staff access: database access is limited to the founder's administrator account. It is used for maintenance, and a client's deals are viewed only when the client asks for support.

Versions, deletion and audit trail

• Every save creates a new version that records the inputs, the scores and the figures shown at that moment. A saved version cannot be edited or overwritten.
• Deleting a deal removes it from the deal list and records who deleted it and when. The owner can restore it.
• On request, CarveOutIQ permanently erases a deal and all its versions.
• Each create, save, delete and restore is logged with the user and a timestamp. Users cannot edit the log.

How the model uses deal data

The CarveOutIQ model is a fixed set of rules and calculations, not an AI model. The same inputs always produce the same figures.

• No AI service reads or processes deal data, and deal data is never used to train any model.
• Deal data is never sent to third parties for analysis, and one client's data is never shown to another.
• Benchmarking uses client data only with the client's written agreement: only derived figures are pooled, each benchmark combines at least five deals, and a client can withdraw at any time.

Not yet in place

These are on the roadmap. We are happy to discuss timing for any that a fund needs before a pilot.

• Single sign-on (Microsoft or Google) and two-factor login.
• CarveOutIQ's own SOC 2 or ISO 27001 certification.
• An independent penetration test of the application.
• Daily database backups with point-in-time restore (comes with the move to a paid database plan).
• A standard data processing agreement and a client-specific retention schedule.
• Shared workspaces, so a deal team can see the same deals.