Sharing a deck is a security event. Most founders treat it as a marketing one
When founders share a deck, they are sharing one of the most sensitive artefacts a company produces. Cap table details, financials, customer names, road map, hiring plans, sometimes contracts.
Most founders treat it as a marketing event. They send it to a list, hope for replies and forget which version went where. The result is a confidential document scattered across investor inboxes with no visibility, no expiry and no way to revoke.
This is the founder side of fundraising security, and it has been ignored for too long.
Why this matters more than founders realise
A pitch deck is shared at the worst possible time, to the largest possible audience, in the most uncontrolled way. Founders share their most confidential information with people they have never met, often within minutes of an introduction.
The risks compound:
The deck gets forwarded to associates, analysts and partners with no founder visibility
Old versions stay in inboxes long after numbers and round details change
Sensitive financials sit in unprotected attachments on personal devices
Confidential customer names show up in screenshots and screen shares
Founders cannot tell who has actually reviewed the company
None of this is malicious. It is just how decks travel. The deck format itself does not give founders any control after the send button is clicked.
What changes with the Caplia Passport
The Caplia Passport is a structured, decision-ready profile shared by secure link, not by file attachment. That single design choice changes the security model entirely.
Access is controlled. Founders decide who has access, what they see and how long the link stays active.
Access is revocable. Once revoked, prior viewers lose access to current and historical content. Links stop working.
Access is tiered. Share a structured first-look preview at the top of the funnel. Deeper materials unlock as conversations progress.
Every action is logged. Every view, every section opened, every download is recorded with timestamp, user and action.
Updates flow. Update once and every active investor sees the latest version. No old versions floating around.
The Caplia security stack
Caplia is built as the infrastructure layer for venture fundraising. Security is treated as such.
ISO 27001 certified. Operational standard for information security management.
Cyber Essentials Plus. Independently verified cybersecurity controls.
GDPR compliant. Founder data ownership stays with the founder. Documented data processing, retention and rights support.
EU AI Act aligned. Iris and every AI workflow operate inside a documented governance framework with transparency, traceability and human oversight.
Encrypted in transit and at rest. TLS 1.3 in transit. AES 256 at rest. Every Passport, document and data point.
No model training on customer data. Customer and founder data is never used to train external models.
Region-specific data hosting. Customer data is hosted in secure, region-specific environments.
What founders should ask before sharing
Before sending fundraising materials, every founder should be able to answer:
Who has access right now
What can each person see
How long does the link stay active
How do I revoke access
Where is the audit log
What happens if my round details change
If the answer to any of these is “I don't know,” the materials should not be sent in that format.
Fundraising security is not a feature of an enterprise plan. It is a baseline. Every founder deserves the same controls institutional investors expect from the platforms they themselves use.