Trust Center

1. What This Trust Center Covers

This page outlines:

• Our compliance position under GDPR, the EU AI Act and PCI DSS
• The security controls that protect your account and data room
• How our AI features work and what stays under your control
• How we classify RaiseTalks under the EU AI Act
• Security documents and how to report a vulnerability

Every control listed here is live in the platform today. Plans are not listed until they ship.

2. Compliance

3. Security Controls

a. Data Protection

• Database and files in the EU – The database and file storage run on Supabase in AWS eu-central-1, in Frankfurt, Germany.
• Encryption in transit – All traffic is served over HTTPS (TLS), and plain HTTP requests are redirected to HTTPS.
• Encryption at rest – Stored data is encrypted at rest with AES-256 by our database and storage provider.
• Private document storage – Data room documents, financials and cap tables sit in private storage buckets and are served through signed links that expire after one hour.
• Encrypted integration credentials – Stripe keys and Google Analytics tokens that founders connect are encrypted by the application with AES-256-GCM before they are stored.

b. Access Control

• Isolation in the database – Row-level security policies, enforced by the database itself, decide which records each account can read or change.
• Tiered data room access – Public, basic, due diligence and owner tiers decide which fields each viewer can see.
• Founder approval – Investors request deeper access and the founder approves it, can set an expiry on due diligence access, and can revoke it at any time.
• Verified pitch deck links – Shared deck links ask each viewer for a one-time email code. Founders see who viewed, when and how often, and can disable or rotate a link.
• Role-based permissions – Founder, investor and moderator roles each have their own permissions. Administrator rights cannot be granted from inside the product.

c. Application Security

• Security headers – A Content Security Policy, frame-ancestors 'none' and X-Frame-Options DENY against clickjacking, MIME-sniffing protection and a strict referrer policy.
• Verified sign-in – Email sign-up requires confirming the address. Google and LinkedIn sign-in are also supported.
• Rate limits – Limits on data room access requests, one-time codes and daily AI usage.
• Payments kept separate – Checkout and billing run on Stripe-hosted pages, outside our application.

d. Privacy

• Self-service export – Download your account data as a JSON file from your profile.
• Self-service deletion – Deleting your account erases your personal data. It also deletes your customer record at Stripe and your contact record at Resend.
• Minimal deletion records – Proof that a deletion happened keeps only a one-way hash of the email address.
• Public-source investor data – Investors listed in our catalogue from public sources can email privacy@raisetalks.ai to have their details corrected or removed.

4. Responsible AI

RaiseTalks uses large language models to draft, summarise and score fundraising material. Our AI features follow four rules:

• No training on your content – RaiseTalks does not train or fine-tune AI models on your data. We access models through Microsoft Azure, whose terms do not allow customer prompts or outputs to be used to train foundation models.
• AI is labelled – Chat runs as the "AI Advisor", rewrites appear as an "AI Suggestion", and scores in the product are marked as AI-generated.
• You stay in control – AI drafts, field proposals and rewrites are suggestions you accept, edit or reject. An investor update is never sent without your confirmation.
• Matching is rule-based – Which investors a startup is matched with is calculated by fixed, weighted rules, not by a language model.

Each AI feature, what it does, and what stays under your control:

5. EU AI Act

a. Our Role

RaiseTalks is the provider of the AI features in its platform. They are built on general-purpose AI models from third parties. We do not develop general-purpose AI models or place them on the market. Founders and investors who use these features professionally act as deployers.

b. Risk Classification

• No prohibited practices (Article 5) – No feature manipulates users, exploits vulnerabilities, scores people socially or uses biometrics.
• Not high-risk (Article 6 and Annex III) – Our features assess companies and fundraising material. They are not used to score individuals' creditworthiness, make recruitment or employment decisions, assess education, or decide access to essential services.
• Transparency duties apply (Article 50) – They cover our chat assistant and AI-generated content. AI interactions and AI output are labelled in the product.
• We review this assessment whenever we add or change an AI feature, and again before Annex III obligations apply on 2 December 2027.

6. Security Documents

Public documents open directly. For documents marked "On request", or anything else your security review needs, email privacy@raisetalks.ai.

We reply to document requests within two business days.

7. Vulnerability Disclosure

We welcome reports from security researchers. Email privacy@raisetalks.ai with a description, steps to reproduce and the impact you see. Please do not include customer data you may have accessed. We do not run a paid bug bounty at this time.

a. In Scope

• raisetalks.com
• app.raisetalks.com
• mcp.raisetalks.com

b. Out of Scope

• Denial of service, load or volume testing
• Social engineering or phishing of our team or users
• Physical attacks, or findings that need a compromised device
• Automated scanner output without a demonstrated impact

c. Our Commitment

• We acknowledge reports within three business days and keep you updated until the issue is resolved.
• We will not take legal action over research done in good faith under this policy: access no more data than you need to show the issue, do not degrade the service, and do not disclose the issue publicly before we have fixed it.

d. Incident Response

If a personal data breach affects your data, we notify you without undue delay, and the competent supervisory authority within 72 hours where GDPR requires it.

8. Updates to This Page

We update this Trust Center when our controls, service providers or AI features change. The revised date is always shown at the top of the page.

9. Contact Us

For security reviews, vulnerability reports or questions about this page:

RAISETALKS AI, Inc.1111B S Governors Ave STE 34329Dover, DE 19904United StatesSecurity and privacy: privacy@raisetalks.aiSupport: support@raisetalks.ai