Security
Cap tables are among the most sensitive records a firm holds. Here is how CapTab is built to protect them — and the answers your IT and compliance teams will ask for.
In brief: CapTab authenticates through your own Microsoft Entra ID tenant, so there are no separate passwords and access ends when someone leaves your firm. Data is encrypted in transit and at rest, hosted on Microsoft Azure in the UK/EU, and every change to the register is logged with the user and timestamp.
CapTab uses Microsoft Entra ID single sign-on over OAuth 2.0, implemented server-side with the Microsoft Authentication Library (MSAL). You sign in against your organisation's own tenant, which means:
CapTab never sees or stores user passwords — authentication is delegated entirely to Microsoft.
All traffic between your browser and CapTab is encrypted in transit using TLS. Data at rest is encrypted on Microsoft Azure SQL, which applies transparent data encryption to the underlying database and backups.
CapTab runs on Microsoft Azure infrastructure hosted in the UK/EU. The application, database and authentication all sit within Microsoft's compliance framework, which carries certifications including ISO 27001 and SOC 2 at the platform level.
CapTab is built on a transaction register, and every change to that register is recorded. User actions — creating and editing entities, instruments and transactions, as well as exports — are written to an audit log with the acting user, the action and a timestamp. That gives you a complete, attributable history behind every figure the system produces.
Each firm's data is logically separated by tenant. Requests are scoped to the authenticated user's tenant, so one firm's data is never visible to another.
If your security team has a questionnaire or specific requirements, we are happy to work through them as part of onboarding. Please get in touch through our contact page and we will respond directly.
This page describes CapTab's security architecture as currently implemented. It is not itself a certification; where certifications are held they are at the underlying Microsoft Azure platform level as noted above.