A check on every table
Every table applies row-level access control (Row Level Security). A member only sees their fund’s data, and only the vehicles open to them.
SECURITY
Every deal stays
inside its fund.
How Casian hosts, isolates and processes a fund’s documents, from the deck upload to the decision.
ParisServer, database and files hosted in Paris.
Every tableIsolation between funds is enforced by the database on every table.
60 secondsLifetime of the link used to read a document, created by the server.
No keyAnalyses hold no access key to AI models.
24 hoursMaximum lifetime of an analysis workspace, deleted after each analysis.
Every dayDatabase backup, and encrypted backup of the files.
One server and one
database in Paris.
The application, the analyses and the AI model gateway run on our server at Oracle Cloud in Paris. The database, accounts and files are hosted by Supabase in its Paris region. Traffic is encrypted (TLS) and Supabase encrypts data at rest (AES-256), according to its security page.
Your teamBrowser, access by invitation
Casian server · Paris
ApplicationQueries the database with the signed-in user’s session
AnalysesOne sandbox per analysis, documents read-only
AI gatewayThe only holder of the key, enforces each step’s rules
Outbound firewallNo access to internal networks
TLSDatabase and files · ParisPer-fund isolation on every table, private files
through the gatewayAI model providerNo training on data sent through the API
through the firewallPublic web and registriesScreening research from a public brief
A fund only sees
its own data.
Isolation between funds is enforced by the database itself, on each of its tables, for every request from the application.
| Fund | Record | Result |
|---|---|---|
| Fund A | Deal 1 | Shown |
| Fund A | Deal 2 | Shown |
| Fund B | Deal 3 | Invisible |
| Fund A → B | Link between deals | Rejected |
No link between two funds
Every record is tied to its fund through its key. The database rejects any reference to another fund’s data.
The user’s own session
The application queries the database with the signed-in person’s session, never with administrator access.
Precise roles
Partner, associate, analyst, committee member, LP, external expert: each role grants defined rights, such as writing an analysis, editing the memo or recording a decision. Access is by invitation.
Rights re-checked
When an analysis starts, and again when it saves its results, the database checks that the person who launched it still has access to the fund. If not, the analysis is cancelled.
Documents checked,
never altered.
The path of a document, from upload to the citations in analyses.
Upload
The file goes through our server, which checks its structure, computes its fingerprint and flags duplicates. 50 MB maximum.
Storage
The original cannot be modified or deleted by a user. Analyses read it read-only.
Reading
The server re-checks access, creates a storage link valid for 60 seconds and streams the file. The link never reaches the browser.
Extraction
Text from PDFs, scans, spreadsheets, presentations and call transcripts is extracted on our server, with no AI model. Every passage keeps its page, slide or cell, and citations point to it.
AI goes through
a gateway.
Analyses have no access key to AI models. A separate gateway, which only answers the server itself, holds the key and sends requests to the model provider.
At the provider
Under its API terms, the model provider does not use the data it receives to train its models. For screening and the investigation steps of due diligence, it keeps requests for 30 days, as those terms provide.
Screening web research
It starts from a brief limited to what is public: the company, its founders, the claims to check. Code removes confidential figures from it, and the research runs in a workspace that contains only this brief.
For each request, the gateway:
- checks the analysis token, valid for a single step and a limited time;
- enforces the model, tools and number of web searches set for that step;
- reserves the maximum cost of the request, and sends nothing if the reservation fails;
- sends a single request to the model provider;
- writes fixed codes to its logs, never prompts, documents or keys.
Every analysis
in its own sandbox.
Each analysis runs in an environment separated from the rest of the server, with no system privileges. Its workspace is deleted at the end, and an hourly task removes any workspace older than 24 hours.
Within reach
- The deal’s documents, read-only
- Its own workspace
- The AI gateway, with a token for the current step
Out of reach
- Other deals and other funds
- The server’s secrets
- An access key to AI models
- Internal networks and cloud metadata
The free screening on our website runs as a separate service, with its own system account and its own key. It has no access to fund data.
A history
you can read back.
What Casian keeps at each stage of a deal.
Document upload
The activity log records it. This log is written by the database itself, not by the application.
Screening
Every document citation carries the exact excerpt. Code compares it with the text of the cited page and removes citations that do not match.
Work on the memo
If two people edit the same memo or calculation, the second one is warned instead of overwriting the first one’s work.
Vote
By default, Casian’s opinion stays hidden until each member has voted, so it does not anchor the team.
Decision
An authorized member records it. It freezes the state of the documents and a copy of the memo at that moment.
Finalized memo
It becomes read-only, including for direct database calls.
Backups, releases
and monitoring.
Backups
Each file backup is encrypted with its own key, and the server only holds the public key. It therefore cannot read its own backups.
database · every dayfiles · every day, encrypted
Releases
A new version is installed only when no analysis is running. It switches on in one step and rolls back automatically if a service does not respond.
Monitoring
Checked every five minutes:
servicesHTTPS certificatememorydiskbackup ageanalysis queue
Errors
Sentry, in its European Union region, receives technical errors. Sending personal data, request content, AI exchanges and IP addresses is turned off.
Tests
Tests apply the real migrations to an in-memory database and check access rules and data integrity directly.
The questions
we are asked.
Where is our data?
In Paris: the server at Oracle Cloud, the database and files at Supabase. AI models are called remotely, at the model provider, with the passages each step needs.
Are our documents used to train models?
No. Under its API terms, the model provider does not use the data it receives to train its models.
Who can see a deal?
The members of your fund, according to their role and the vehicles open to them. Other funds have no access; the database prevents it.
How can an analysis be checked?
References point to the passages used: PDF page, spreadsheet sheet and cells, or text paragraphs depending on the source. Versions make it possible to find the documents and memo that were reviewed.
How do you get your work back?
Memos export to PDF and Word. Fund data export and the deletion process are documented. Exit and retention terms are agreed at the start.
Where is the list of providers?
On the Data and providers page, with the role of each one.
Your next deal.
A shared place to think.
We open access in small batches.
Each fund starts with a deck it has received.