Private from the start
New projects and founder records are private by default. Signing in does not make another founder’s company visible.
SECURITY & PRIVACY
Private by default. Shared by choice.
StartupOne is designed to make company access a decision you can understand. The public site explains the product; your business records belong in an authenticated, owner-scoped workspace.
We describe the product’s access model here, not an unverified certification or a guarantee that every risk has been eliminated.
HOW ACCESS WORKS
Ten boundaries that keep the picture clear.
Owner-scoped records
Records are associated with their owner. Server-side checks and record-level rules help enforce who may see or change them.
Organization roles
A role describes what a teammate may do; organization membership alone does not give access to every project or workspace.
Explicit sharing
Share a specific resource with a specific person. Access and scope are assigned deliberately rather than inherited silently.
Revocable access
Review collaborators and revoke a grant when work ends. LEGENYX project review is a separate, time-limited sharing choice.
Platform Owner is different
Platform operations use a configured owner identity, not a generic founder role. Private founder context is not an admin browse surface.
Bring your own AI
You choose a provider, model and context classes. Normal founder AI requests do not fall back to shared customer AI capacity.
Credentials stay protected
Provider credentials are encrypted and handled server-side; the connected-provider screen does not show saved secrets.
Advice is not authority
AI output is a suggestion, not a verified result, permission or completed action.
Evidence and audit trails
Sensitive access and approved actions have recorded evidence. An audit trail does not replace independent security testing.