Trust & Security

What We Protect, and What We Do Not Claim

FounderGrade handles credibility data and other people’s capital. This page states exactly how both are secured, and is written to be checked rather than admired.

Pursuing DFSA Innovation Testing Licence · DIFC, Dubai

Security architecture

Data at rest is encrypted with AES-256; data in transit uses TLS 1.3.
Expert review is blind, so reviewers never see founder identity, cap table ownership, or investor names attached to a file.
Blind Review Pool and Directory Experts are kept separate. An expert who has had a Direct Engagement with a founder is permanently excluded from that founder's Blind Review Pool. An expert who has Blind Reviewed a founder is excluded from Direct Engagement with that founder for 12 months.
Access to production data is role-scoped and logged. Every admin action writes to an immutable audit trail.
We do not claim SOC 2, ISO 27001, or any other certification. When we complete an audit, we will publish the report reference here.

Escrow integrity

Escrow is enforced by audited programmable contracts. The settlement infrastructure will be confirmed before launch and published here.
Releases require 2-of-3 signatures: founder, investor, and an assigned expert. No single party can move funds.
Every deposit, milestone release, and refund is independently verifiable and linked from the deal room.
Contested milestones route to built-in dispute arbitration before any release is executed.

Regulatory posture

We are pursuing a DFSA Innovation Testing Licence in DIFC, Dubai. We are not currently licensed or regulated by the DFSA, and we do not describe ourselves as such.
DIFC is our single launch jurisdiction. India is a sequenced later phase and the United States is sequenced after that, both through locally licensed partners. Neither is open today and we do not accept business in either.
We do not hold client deposits ourselves. Fiat balances sit with regulated payment and custody partners; escrowed balances sit in the escrow contract.
Investor access is restricted to accredited or professional investors as defined in their jurisdiction.

How we make money

Founders: free to join. A Single Expert Assessment starts at $180 and a Blind Double Assessment at $450, in both cases the expert rate plus the service fee, so nothing is sold below what the experts are paid. 1% success fee on funded rounds.
Investors: 2.5% on funded deals.
Programmes: commissioned assessments from $165 per company, billed to the programme rather than the founder.
Experts: experts set their own rates and receive them in full. We add a 20% service fee on top, which founders see itemised before they commit.
Accelerators: plans from $199/month.
Every completed assessment is recorded permanently. A founder controls whether the score value is revealed, never whether the assessment is known to exist.
No listing fees, no carried interest, no hidden spreads on escrowed capital.

Data handling

KYC and KYB are performed by vetted identity providers; we store verification outcomes, not raw identity documents, beyond the retention period required of us.
You can export your data at any time and request deletion. We delete on request, except where records must be retained for legal or anti-money-laundering obligations.
We do not sell personal data or share it with advertisers.

Automation, and Where It Stops

Automated tooling drafts, extracts and flags. It never produces a score, never verifies a milestone and never releases money. Every one of those is a decision recorded against a named person. The full division of labour, the limits of the assistance and the appeals path are published in the methodology.

Read The Methodology

What Verification Means, in Writing

The evidence thresholds, the three outcomes, the conflict rules, the tie break and the appeals timetable are published as a versioned standard. Institutional buyers can also read how programme and grantee data is handled.

Verification Standard Data Handling for Programmes

The Record and Attestation Model

Attestation-based record keeping is an established pattern in grant tooling, so programme operators reasonably ask how a verification is anchored. Here is exactly what is recorded, what is public, what never leaves the platform, and how a third party checks a finding without asking us.

What Is Recorded	Where It Lives	Who Can See It	Detail
That a verification engagement was opened	Anchored	Public	A milestone identifier, the programme identifier and a timestamp. No evidence and no narrative.
The finding: Corroborated, Contradicted or Unable To Verify	Anchored	Public	The outcome, the standard version applied, the verifier tier and a timestamp.
A cryptographic digest of the written reasons	Anchored	Public	A hash only. Anyone holding the reasons document can confirm it is the one that was recorded, and nobody can read it from the hash.
The written reasons themselves	Off Chain	Programme and Parties	Held in the platform record, released to the programme and the verified party, and exportable by both.
The evidence the grantee submitted	Off Chain	Parties Only	Never anchored, never published. Confidential material stays confidential by design, not by policy alone.
Verifier identity	Off Chain	Programme and Parties	Disclosed to the programme and the grantee for conflict checking. The public record carries the tier and calibration status, not a name.
Appeals and overturned findings	Anchored	Public	An overturn is recorded as a new entry referencing the original. Nothing is deleted or rewritten.

That a verification engagement was opened

Anchored · Public

A milestone identifier, the programme identifier and a timestamp. No evidence and no narrative.

The finding: Corroborated, Contradicted or Unable To Verify

Anchored · Public

The outcome, the standard version applied, the verifier tier and a timestamp.

A cryptographic digest of the written reasons

Anchored · Public

A hash only. Anyone holding the reasons document can confirm it is the one that was recorded, and nobody can read it from the hash.

The written reasons themselves

Off Chain · Programme and Parties

Held in the platform record, released to the programme and the verified party, and exportable by both.

The evidence the grantee submitted

Off Chain · Parties Only

Never anchored, never published. Confidential material stays confidential by design, not by policy alone.

Verifier identity

Off Chain · Programme and Parties

Disclosed to the programme and the grantee for conflict checking. The public record carries the tier and calibration status, not a name.

Appeals and overturned findings

Anchored · Public

An overturn is recorded as a new entry referencing the original. Nothing is deleted or rewritten.

How a Third Party Confirms a Verification Happened

1Take the milestone identifier from the programme's own record or from the finding document.
2Resolve it against the published record to see whether an engagement was opened and what the outcome was.
3Hash the reasons document you were given and compare it to the digest on the record. A match proves the document is the one that was recorded and has not been altered.
4Where the programme publishes a transparency page, the same identifiers appear there, so a community member can perform the same check without our help.

The Network Is Not Yet Chosen, and We Will Not Pretend Otherwise

The specific EVM-compatible network has not been selected. We will not name one before the decision is made, because naming a network we have not committed to would be misleading.
No contracts are deployed today. The platform is pre-launch and nothing described here is running in production.
Contract addresses, the network choice and the record schema will be published at launch, on this page, before any production record is written.
The record model is deliberately portable: identifiers, outcomes and digests, with no dependency on any single network's features. If the network choice changes, historic digests can be re-anchored on the new network with the original timestamps retained off chain and the migration published.
Anchoring is a durability and tamper-evidence mechanism. It is not what makes a finding credible. The verifier's independence and the published standard are what make a finding credible.

Found Something That Looks Wrong?

Security reports and factual corrections go to security@foundergrade.ai. We acknowledge within 24 hours.

Score Integrity

You Cannot Shop for a Better Score

Every completed assessment is recorded permanently, whatever it says. Founders decide which scores to reveal. They never decide whether an assessment shows up.

The Conflict Everyone Ignores

Conventional ratings are paid for by the thing being rated. That is the issuer-pays model, and it is what produced ratings inflation at the credit rating agencies. If the subject can also bury a poor result, every published score is good by construction and tells you nothing.

What a Founder Controls

A founder chooses which assessment scores to reveal. That is the only lever. A founder can never delete an assessment record, and can never hide that an assessment happened. The count, the date and the rubric version are permanent and public.

Why That Ends Score Shopping

Ordering assessments until one comes back flattering does not work when the ledger shows three completed and one shared. Non-disclosure becomes its own signal, so nobody has to be forced to publish a bad number for the number to mean something.

What an Investor Sees

3 Assessments Completed, 1 Shared, Most Recent March 2026

The value of a sealed assessment is never revealed, only that it exists and when it happened. Illustrative example of the ledger format.

And the Strongest Assessments Are Not Bought by the Founder

A programme-commissioned assessment is paid for by the accelerator, fund or programme rather than the company being assessed. That inverts the conflict rather than merely disclosing it, and it is why those assessments carry more weight in the ledger.

See How Assessments Are Priced