Security and data protection
A summary for programme teams and the IT and information-governance colleagues who review suppliers. The full security and privacy pack, with answers to a typical university security questionnaire, is available on request from security@makefounders.com.
At a glance
| Area | What we do |
|---|---|
| Your data, separated | Every record belongs to one organisation, and every request is checked against the organisation, programme and startup of the person making it. Automated tests try every route as a member of another organisation; all must be refused. |
| Signing in | Email and password, optional two-step verification with an authenticator app, and single sign-on through Microsoft Entra ID, Google Workspace or another OpenID Connect provider. You can require two-step verification or single sign-on for your staff. |
| Who sees what | Roles decide it: founders see their own startup, mentors only the startups they are assigned to, reviewers only applications, directors everything but read-only. Private notes stay private. |
| Our own access | A small number of named MakeFounders staff, with two-step verification. Looking at your workspace needs a written reason, is limited to 30 minutes, cannot change anything, and appears in your audit log. |
| Audit log | Sign-ins, administrative and security actions, exports and support access are recorded for each organisation. |
| Your data, out | Export any table as a spreadsheet or everything as one archive, at any time. An API and webhooks are available. |
Data protection: UK GDPR and Singapore PDPA
Your organisation is the controller of your founders’, mentors’ and applicants’ data. MakeFounders is your processor and acts on your instructions. The tools you need to meet your own obligations are in the product:
- Access and portability. Anyone can download their own data from their account page.
- Erasure. Anyone can ask for their account to be erased. Each organisation they belong to approves the request, or declines it with a reason.
- Retention. You set how long unsuccessful applications and audit records are kept.
- Consent for sensitive questions. Optional demographic questions are asked separately, need explicit consent, and are reported only in aggregate.
- Breach notification. We tell affected customers without undue delay, and within 72 hours of becoming aware of a personal-data breach.
See the privacy notice and the data processing summary.
Where data is stored
MakeFounders stores customer data in the UK and the European Union. A deployment in Singapore can be arranged for customers who need their data to stay there. A small number of suppliers process data on our behalf; they are listed in the privacy notice.
AI and your data
- AI features run through one supplier, OpenAI, whose terms for its API exclude using your data to train its models.
- Each feature sends only what it needs: for example, a startup’s check-ins and evidence for a summary. Interview participants’ names are replaced before anything is sent.
- AI never changes your data by itself. It drafts and suggests; a person confirms.
- AI sees only what the person asking is allowed to see.
- An organisation’s owner can switch all AI features off. Nothing is then sent to the AI supplier for that organisation.
Application security
- Passwords are stored with bcrypt and never logged. Repeated failed sign-ins lock the account for a time.
- Secrets you give us, such as single sign-on client secrets and webhook signing secrets, are encrypted in the application as well as by the database.
- Uploaded files are checked by content, stored under random names and downloaded through short-lived links.
- The web application loads no third-party scripts, fonts or trackers, and a content security policy enforces that.
- Rate limits protect sign-in, password reset and public forms.
- Dependencies are audited and the code is scanned for secrets before each release.
Cookies
This website sets no cookies. The application sets one to keep you signed in, and a second for ten minutes if you sign in through single sign-on. There are no analytics or advertising cookies.
What is not yet in place
We would rather say so than have you assume otherwise.
- Independent penetration test. None yet. It is planned before general availability.
- Certifications. We do not hold ISO 27001 or SOC 2. Cyber Essentials is our first target. Our hosting suppliers hold their own certifications.
- SAML single sign-on. OpenID Connect only for now.
- Virus scanning of uploads. Built, and switched on per deployment.
- Contractual service level. Agreed with each customer during pilots; there is no public status page yet.
Reporting a security problem
Email security@makefounders.com. We will acknowledge your report and keep you informed.