Security, Privacy & Platform Controls
Security, privacy, and controls for sensitive deal-room work
How Sprowtt approaches access management, data protection, platform controls and issuer-controlled workspace activity. Sprowtt provides software tools and does not provide legal, tax, accounting, or investment advice.
Our commitment, in plain language
Sprowtt is designed to support secure, organized workspaces for sensitive company materials and stakeholder communications. We focus on clear access controls, responsible data handling and transparent platform practices — and on describing only controls that are actually in place.
Access and permissions
- Role-based access: issuer, counsel, investor and administrator roles, checked on the server for every account function — an automated check in the build fails if a function is added without one
- Workspace-level and document-level visibility, set by the issuer
- Invitations for authorized stakeholders, and revocation that takes effect straight away
- Administrator seats locked to a city or a law firm by the profile, never by the web address
- Suspending a user signs them out of every session at once
- Sign-in, sign-up and password-reset attempts are rate-limited
- Every document open and download is recorded against the version seen
Data protection
Hosting details, including provider and region, and further information about available controls can be provided to qualified customers on request.
- Encrypted connections (HTTPS) in production, with strict transport security and security headers on every page
- Uploaded files are never served directly; every read passes an access check
- An uploaded file must match its declared type by its contents before it is stored
- Bank routing and account numbers are stored encrypted, and only the last four digits are ever shown
- Only the last four digits of a taxpayer number are kept on a cap table
- Database backups; records such as payments and documents are voided or removed from view rather than deleted, so history survives
Privacy and data use
Sprowtt uses personal and workspace information to operate, secure, support and improve the platform, as described in our Privacy Policy. We use contact details submitted through this website to respond to the request made.
Recording of how visitors use a deal room is described to those visitors before it is switched on, and issuers see patterns of activity for their own room. Requests to access, correct or delete personal information can be sent to info@sprowtt.com.
AI-generated engagement insights
Sprowtt may generate plain-language summaries of recorded workspace activity. These summaries are informational only. They do not provide investment advice, legal or regulatory advice, pricing or offering recommendations, or predictions of investor behaviour or fundraising outcomes.
Summaries may be inaccurate, incomplete, or affected by small samples and tracking limitations. Review the underlying activity and consult your own qualified advisors before acting on any information.
Third-party services
Some capabilities rely on third-party providers when they are enabled: hosting and infrastructure, email, video meetings and recording, accreditation verification, payments for subscriptions, and analytics. When enabled, those providers process information under their own contractual terms and privacy practices, and the services available depend on the customer's configuration and agreements.
Where a provider verifies identity or accreditation, processes a payment, or holds escrow, that provider — not Sprowtt — performs the service.
Compliance workflow support
Sprowtt provides configurable software features that may support issuer and advisor workflows, including document organization, controlled sharing, activity records, counsel review and communications. Sprowtt does not determine whether an offering, disclosure, communication or transaction complies with applicable law.
What we are not claiming
This page does not claim a SOC 2 report, an ISO certificate, a PCI attestation, an uptime guarantee or any audit Sprowtt has not had. When one exists it will be named here with its date and scope.
Report a concern or request information
To report a security concern, or to request available security documentation as a qualified customer or prospect, email info@sprowtt.com with "Security" in the subject line. For account help, use the same address.