Access controls
Private company workspaces, scoped adviser permissions, tenant-level database controls and MFA requirements for new accounts and privileged users. Signing an NDA does not automatically grant Data Room access.
Document processing
Uploaded documents pass security screening before downstream processing. Classification and analysis can require human review; “security clean” does not mean the contents are accurate or complete.
Reviewable decisions
Findings include recorded evidence. Valuation outputs remain indicative; users can record corrections and disagreements. Internal review is not independent professional validation.
Processing services
The implementation uses the services below. Exact contractual entities, regional routing, data-transfer terms and the final subprocessor register require confirmation in your applicable service agreement.
| Service | Purpose |
|---|---|
| Vercel | Application hosting and request processing |
| Supabase | Database, identity and application services |
| Amazon Web Services | Document storage and processing infrastructure |
| OpenAI | Requested AI-assisted analysis of permitted inputs |
| Stripe | Subscription payment processing |
| Resend | Planned transactional email delivery; end-to-end delivery remains unverified until connected |
Assessment status
Engineering security checks are not a substitute for an independent penetration test. Independent testing and professional valuation validation remain pre-launch work. No SOC 2 or ISO certification is claimed for ExecCraft.
Retention and exit
The current cancellation workflow schedules active workspace deletion after 90 days, unless Archive or a legal hold applies. Encrypted backups may take up to 30 additional days to expire. Confirm the applicable cancellation and refund terms before purchasing.
Operating company and contact
The operating legal entity is awaiting owner confirmation for public display. Check the provider identity in your order before purchasing.
Do not include customer data or exploit payloads in an initial security enquiry.
Contact options →