How GPX handles your data.

Documents you upload — teasers, information memoranda, term sheets and similar files — are parsed entirely in your browser. Only the extracted text is transmitted to GPX and to our matching provider, OpenAI, for analysis. The extracted text of a document is its substantive content, so please only upload material you are comfortable sharing for that analysis.

GPX drafts introductions and outreach for you to review. GPX never sends messages or outreach on your behalf. Any hands-on, managed outreach is only available through a separate Greenpeak advisory engagement and only with your written approval for each message.

All data is encrypted in transit using TLS 1.2 or higher, and encrypted at rest using AES-256. The primary database, authentication service and file storage are hosted on Supabase infrastructure in the European Union, region eu-west-1 (Ireland). Backups are retained in the same region.

The following subprocessors handle limited categories of your data on our behalf. This list matches the subprocessors named in our Privacy Policy.

Account information and any briefs you upload are retained for as long as your account is active. On request following account closure, all associated personal data and uploaded-brief content is deleted from production systems within 30 days. Backup copies expire on the standard backup rotation.

To request deletion, email privacy@101globalcapital.com from the address on your account.

• Role-based access control for every application surface.
• Row-level security enforced at the database layer on all customer data.
• API keys are hashed at rest and shown to you exactly once at creation.
• Service credentials are scoped to least privilege and rotated on staff change.
• Administrative access is audit-logged with immutable records.
• Production secrets are stored in a managed secret store, not in source control.

In the event of a confirmed personal-data breach affecting your account, we will notify you without undue delay and, in any case, within 72 hours of becoming aware of the breach, together with the information required to understand its scope and any recommended action on your side.

GPX is not yet SOC 2 certified. A SOC 2 Type II readiness programme is planned for 2027. Until then, the controls described on this page — encryption, EU hosting, RLS, least-privilege access, audit logging and breach notification — are the controls we operate today. We do not claim any certification we do not hold.

For security reports, vulnerability disclosures or urgent questions about data handling, contact the security role alias:

security@101globalcapital.com

Monitored by the GPX security team — not a personal mailbox.