Skip to content

Security

How we protect your cap table

Ownership data is among the most sensitive a company has. This page describes what EZDocs Captable actually does today, taken from how the service is built and deployed. Where we don't do something, we say so.

No certifications yet. EZDocs Captable has not completed a SOC 2, ISO 27001 or similar audit. We rely on the security of AWS and the controls below, and will update this page if that changes.

Hosting and region

  • The app runs entirely on Amazon Web Services, in the US East (N. Virginia) region, us-east-1: AWS Lambda behind Amazon API Gateway, served through Amazon CloudFront.
  • The ledger lives in Amazon DynamoDB; uploaded documents, logos and generated exports live in private Amazon S3 buckets.
  • The infrastructure is defined as code (AWS CDK) and deployed from our repository through short-lived GitHub OIDC credentials, not stored access keys.
  • Payment keys and the app's signing secret are kept in AWS Secrets Manager, not in code or configuration. Card payments are handled by Stripe; card numbers never reach our servers.

Encryption

  • In transit: HTTPS only, TLS 1.2 or later at CloudFront and between CloudFront and the API. Browsers are told to use HTTPS for a year (HSTS). The S3 buckets refuse any request that isn't over TLS 1.2+.
  • At rest: the DynamoDB table is encrypted with an AWS-managed KMS key; the S3 buckets use server-side encryption (SSE-S3, AES-256).
  • All S3 buckets block public access. Files are only ever downloaded through signed links: 15 minutes for documents, and 7 days for scheduled export emails (those also stop working if the recipient is no longer an Admin or Manager of the company).

Sign-in

  • Accounts live in Amazon Cognito. There are no passwords to reuse or phish: you sign in with a single-use link emailed to you, which expires after 15 minutes. Only a hash of the link's token is stored.
  • Password sign-in is turned off for the app; sessions use one-hour tokens that are refreshed for up to 30 days and can be revoked.
  • Sign-in requests are rate-limited per address and across the service.
  • Our internal admin area has its own sign-in with a time-based one-time code (TOTP), separate from customer accounts.

Access control and isolation

  • Every company is separate. Its records are stored under that company, and every API request is checked against your membership of that specific company before anything is read or changed.
  • Role-based access: Admins manage members, the board and billing; Managers edit the cap table and documents; Viewers read the cap table on screen and can't open documents, download or export; Stakeholders see only their own holdings in the holder portal.
  • Roles are enforced by the server on every request, not just hidden in the interface.

Audit log and data integrity

  • Every change is recorded with who made it and when, down to the individual fields that changed and their values before and after. Admins and Managers can export the log as CSV.
  • Optimistic locking: if someone else changed a record since you opened it, your edit is refused instead of silently overwriting theirs.
  • Cap table math uses exact decimal arithmetic, and the ledger is checked for inconsistencies (over-issued classes, dangling references and the like) continuously.

Backups and deletion

  • The DynamoDB table has point-in-time recovery turned on, so it can be restored to any second in the last 35 days, and deletion protection in production.
  • The documents bucket is versioned: an overwritten or deleted file can be recovered for 90 days.
  • You can download a full backup of a company's ledger at any time, and export it to Excel, CSV, PDF or Open Cap Format.
  • A deleted company can be restored by its Admins for 30 days; after that it and its files are removed for good.

Email

  • Email is sent with Amazon SES from our own domain, signed with DKIM, with a custom MAIL FROM domain for SPF alignment.
  • Delivery requires TLS, so sign-in links never cross an unencrypted mail hop.
  • Addresses that bounce or complain are suppressed, and optional emails (summaries, reminders, notices, scheduled exports) carry one-click unsubscribe.
  • Exports are never attached to email: messages carry an expiring download link instead.

Application hardening

  • A strict Content Security Policy, and headers that stop the app being framed (clickjacking) or content types being sniffed.
  • Uploads are type- and size-checked, and archive-based files are inspected before they are parsed.
  • CSV exports defuse spreadsheet formula injection in names and notes.
  • Server errors raise an alarm to the team.

Reporting a vulnerability

If you believe you've found a security issue, email security@ezdocs.io with the steps to reproduce it. We'll acknowledge your report, keep you updated, and credit you if you'd like.

Please test only against accounts and companies you own, don't access or change other people's data, and give us reasonable time to fix the issue before disclosing it. We won't take legal action against good-faith research that follows these rules.

Ready to put your cap table somewhere safe?

Cap table management, SAFE and note tracking, round modeling and exit waterfalls, for one price per account.

Explore the features See plans and pricing