Security for sensitivedecision material.
Zurvek processes pitch decks, financial models, cap tables, and business plans — documents containing unpublished financial data and proprietary business strategies. This is not consumer software. The security architecture reflects that.
Data Architecture
Private document storage: Uploaded files may be retained to provide evaluations, reports and authorized follow-up. Access is restricted to the owning workspace and authorized service operations.
Processing: Application data and documents are handled by contracted service providers under confidentiality and security controls. We do not publish an unverified hosting-region promise. This is a description of current practice, not a certification or independent audit result.
Regulatory Posture: VentureSense Technologies LLP operates as a Data Fiduciary under India's Digital Personal Data Protection Act, 2023. Cross-border transfers are made on the basis set out in our Privacy Policy, with a published grievance route.
Security controls
| Layer | Standard |
|---|---|
| Data in transit | Encrypted transport |
| Stored application data | Managed encryption at rest |
| Authentication | Managed sessions and token rotation |
| Tenant isolation | Organization-scoped access policies |
| Privileged operations | Server-side authorization and audit controls |
Access Controls
- All evaluation data behind authentication. No public access.
- Role-based access for Syndicate and Institutional tiers.
- Sessions expire after inactivity. Concurrent limits by tier.
- Internal staff access logged, audited, and limited to essential personnel.
Third-Party Sub-processors
Zurvek uses contracted providers for application operation, storage, analysis, payments and communications. Provider controls and retention can differ by category; Zurvek applies contractual confidentiality and data-handling requirements.
A current list of processors is available on written request to support@zurvek.com.
Vulnerability Disclosure
Contact: support@zurvek.com · PGP key available on request.
- • Include reproducible steps and the affected page or account boundary
- • Do not access, retain or disclose other users' data
- • Avoid disruption, automated scanning and social engineering
- • We assess reports by severity and communicate when practical
What We Do Not Do
- • We do not sell user data to any third party
- • We do not allow model providers to train on your raw documents
- • We do not share evaluation outputs with any party other than the authenticated account holder
- • We do not store payment card data
- • We do not claim SOC 2, ISO 27001, or PCI certification — where controls above map to a framework, they are described factually, not certified
Anonymized signals used for benchmark corpora are governed by the Privacy Policy §3; opt out via support@zurvek.com.
Last updated: 8 October 2026 · Conservative factual draft pending Indian counsel review · VentureSense Technologies LLP · LLPIN: ACR-5230 · support@zurvek.com