Data
Protection.
Our comprehensive framework for protecting the personal and financial data of founders, investors, and all platform users. Built on DPDPA, IT Act, and international best practice.
Legal Framework
VentureSuite's data protection practices are built on a comprehensive legal framework that incorporates Indian statutory requirements alongside international best practice standards.
Data Controller & Processor
Understanding the roles of data controller and data processor is fundamental to our data protection framework:
| Role | Entity | Responsibilities |
|---|---|---|
| Data Controller | Venture Biz Care LLC (VentureSuite) | Determines the purposes and means of processing personal data collected through the Platform. Bears primary legal responsibility for data protection compliance. |
| Joint Controllers | Founders & Investors (for shared campaign data) | Both parties exercise some control over data shared in the deal progression process. A shared responsibility framework applies to data room access and intro facilitation. |
| Data Processors | AWS, Razorpay, Postmark, PostHog | Process data only on our documented instructions. Bound by data processing agreements under IT Act / DPDPA Article 8 equivalent obligations. |
| Data Principal | Individual users (founders, investors, team members) | Rights-bearing subjects whose personal data is processed. Entitled to exercise all rights under applicable law including access, correction, and erasure. |
Data Protection Officer: VentureSuite has designated a Data Protection Officer (DPO) responsible for overseeing our data protection strategy and compliance. The DPO can be reached at legal@theventuresuite.com.
Data Protection Principles
Our data processing activities are governed by the following core principles, applied consistently across all systems and operations:
SaaS Platform Data
Data flows differently depending on your role on the Platform. The following describes what data is collected, processed, and how it moves through the system:
- Founder profile and campaign data is stored in our primary database (AWS RDS, encrypted at rest).
- Readiness scores are computed algorithmically from submitted data and stored alongside the campaign. Score breakdown (full) is visible only to our admin team — investors see only the total score.
- Campaign data is surfaced to matched investors through the investor feed. Contact details are withheld until an intro is accepted.
- Pitch deck and documents are stored in S3 with server-side encryption and served only via signed, time-limited URLs.
- Investor profile and thesis preferences are stored and used by the matching engine to generate personalised feed rankings.
- Investor identity is revealed to founders only when the investor formally requests an intro — not at the follow or shortlist stage.
- Investor activity (follows, shortlists, intro requests, data room views) is logged and available to the investor and to the relevant founder on a need-to-know basis.
- Investor subscription and billing data is processed by Razorpay/Stripe and only the subscription tier and status is stored in our systems.
Financial & Confidential Data
Financial information shared on VentureSuite — including revenue figures, financial models, cap tables, and valuation data — is treated as highly sensitive and receives additional protections beyond standard personal data.
We never use your financial data for our own commercial purposes. Revenue figures, financial models, and deal data will never be aggregated for sale, used to train external AI models, or shared with third parties other than your explicitly authorised investors and our regulated service providers.
Security Architecture
Our security architecture is designed around a defence-in-depth model with multiple independent layers of protection:
| Layer | Control | Standard |
|---|---|---|
| Data at Rest | AES-256 encryption; database + field level | NIST SP 800-111 |
| Data in Transit | TLS 1.3; HSTS enforced; certificate pinning | NIST SP 800-52 |
| Access Control | RBAC + ABAC; MFA mandatory for admin; least privilege | NIST SP 800-53 |
| Document Access | Signed S3 URLs; 1-hour expiry; IP logging | AWS S3 Security |
| Infrastructure | VPC isolation; WAF; DDoS protection; private subnets | AWS Well-Architected |
| Application | OWASP Top 10 controls; input validation; CSP headers | OWASP ASVS L2 |
| Audit Logging | Immutable CloudTrail logs; 7-year retention; SIEM alerting | CIS Controls v8 |
| Penetration Testing | Annual third-party pentest; quarterly vulnerability scans | OWASP Testing Guide |
Breach Response
Despite our comprehensive security controls, we acknowledge that no system is immune to all threats. Our breach response procedure ensures rapid containment, assessment, and notification:
Data Protection Impact
VentureSuite conducts Data Protection Impact Assessments (DPIAs) for processing activities that are likely to result in a high risk to individuals' rights and freedoms. DPIAs have been conducted or are planned for:
- Algorithmic scoring: The deterministic scoring engine processes founder financial and team data to produce a quality score. DPIA confirmed: mitigated by transparency (founders can see scoring dimensions), human oversight (admin review), and right to contest.
- Investor matching algorithm: Personalised feed ranking based on thesis preferences. DPIA confirmed: no protected characteristics used, no discriminatory profiling, based purely on stated commercial preferences.
- Data room access logging: Comprehensive logging of investor document access. DPIA confirmed: necessary for founder protection and security; logs are only accessible to the founder and admin team.
- Payment processing integration: Financial data transmitted to payment processor. DPIA confirmed: mitigated by tokenisation, no card storage, processor compliant with PCI-DSS Level 1.
DPIA outcomes and mitigation measures are documented internally and reviewed annually or whenever the processing activity materially changes.
Vendor Management
We apply rigorous standards to all third-party vendors who process personal data on our behalf. Our vendor management framework includes:
- Pre-engagement assessment: Security and privacy due diligence before any vendor engagement, including review of their SOC 2 Type II report, privacy policy, sub-processor disclosures, and incident history.
- Data Processing Agreements (DPAs): All vendors who process personal data sign a DPA that requires them to: process data only on our instructions, implement equivalent security controls, notify us of any breach within 24 hours, and delete data upon termination.
- Annual review: Vendor compliance is reviewed annually. Material changes to a vendor's security posture or sub-processor list trigger an immediate reassessment.
| Vendor Category | Data Accessed | Location | Certification |
|---|---|---|---|
| Cloud Hosting (AWS) | All platform data | Mumbai / Singapore | ISO 27001, SOC 2 Type II |
| Payment Processing (Razorpay) | Payment card tokens | India | PCI-DSS Level 1, RBI compliant |
| Email Delivery (Postmark) | Email addresses only | USA (SCCs applied) | SOC 2 Type II |
| Analytics (PostHog / self-hosted) | Anonymised usage data | EU / Self-hosted | GDPR-compliant (self-hosted) |
Governance & Accountability
Our data protection governance structure ensures that accountability is embedded at every level of the organisation:
For data protection enquiries or to exercise your rights, contact: legal@theventuresuite.com
Questions about
data protection?
Our Data Protection Officer is available to answer technical and compliance questions about how we protect your data.
