Security and data
Built so your data stays yours
Deal flow is confidential: founders trust you with their numbers and their decks. Here is how Xpand stores that data, separates it and uses it, in plain words.
01At a glance
The short version
- Database region
- EU (Ireland)
- Data separation
- Row-level security on every table
- Pitch decks
- Private storage, links expire after an hour
- CRM access
- Read only
- AI models
- Anthropic Claude, with OpenAI as a fallback
- Data processing agreement
- Available on Enterprise
02Your data
Where it lives and who can see it
- 01
Stored in the EU
Your workspace lives in a database hosted in the EU, in Ireland. We built for GDPR from day one rather than adding it later.
- 02
One wall per company
Every record carries the id of the workspace it belongs to, and the database itself only returns rows for the workspace of the person signed in. This is enforced by row-level security on every table, not by checks in the app that could be missed.
- 03
Pitch decks stay private
Decks founders upload are kept in private storage. They open through links that expire after an hour, handed out only to people signed in to your workspace, and the same goes for the read-only export Unlocked uses.
- 04
Read-only CRM access
When the HubSpot and Salesforce connectors arrive, they will use read-only tokens. Xpand reads from your CRM and never writes back to it.
- 05
Separate keys for each lead source
Each website or partner that sends leads into Xpand has its own key, so one can be switched off without touching the others. Booking requests are rate limited and checked for bot spam.
03AI you can check
The AI explains itself, and people decide
- 01
Reasoning on every answer
Every fit score and recommendation comes with the reasons behind it, in plain words. There are no black-box numbers.
- 02
People can override
Any score can be overridden by your team, and your judgement wins over the model.
- 03
Suggestions, not actions
Agents draft and suggest. Enrichment is never applied on its own, tasks are created only when someone clicks, and no email is sent without a person.
- 04
Untrusted text stays data
What founders type into public forms, and what is in their decks, is passed to the AI as evidence to review, never as instructions. The answer comes back in fixed, length-limited fields.
- 05
Honest about what it does not know
The Researcher keeps founder claims apart from checked facts, and reports a signal as unknown when it could not check it, rather than guessing.
Try it on your next founders
Create a workspace, connect your website form or open a booking page for your next event, and read why each founder got their score.
No card needed for the trial.