PE operating partners trust RollForge with proprietary portco financials, operational data, and benchmarking data that don't leave the firm. We take that seriously. This policy explains exactly what we do with your data — and what we will never do with it.
We collect the minimum data necessary to provide the Platform. This includes:
Account data: Name, email address, organization name, and password (stored as a salted hash — we never store plaintext passwords). Role assignments within your organization.
Customer Data: Portfolio company data, financial data, operational metrics, vendor spend data, KPI goals, and any other content you upload or enter into the Platform. You control this data entirely.
Usage data: Log data, feature usage patterns, IP addresses, and browser/device information — used to operate, maintain, and improve the Platform.
Communications: Email address and any content you send to us via support or inquiry forms.
We do not collect payment card data directly. Payments are processed by Stripe, our payment processor. See our Subprocessors section for details.
All Customer Data you upload to RollForge remains your property. We do not claim any ownership over your portfolio company data, financial information, operational data, or any other content you provide.
You retain full intellectual property rights in your Customer Data at all times. RollForge holds only a limited operational license to store and process that data for the purpose of providing the Platform to you — and for no other purpose.
You can export your data at any time from your account. On account termination, you retain the right to export all Customer Data before deletion. See Data Retention & Deletion for timelines.
RollForge enforces strict logical data isolation between customer accounts:
RollForge will never sell, rent, license, or otherwise monetize your Customer Data with any third party — ever.
We do not share your Customer Data with third parties except in the following limited circumstances:
In all cases, we contractually require our subprocessors to maintain confidentiality and data protection standards at least as protective as those described in this Policy.
We use the data we collect for the following purposes:
RollForge enforces role-based access control (RBAC) within each organization:
Audit logging. RollForge logs data access and modification events at the application level. Access logs are retained for compliance and security incident investigation purposes. We are committed to expanding audit log coverage and making audit trails available to Enterprise customers as part of our security roadmap.
RollForge staff access. Access to production customer data by RollForge personnel is restricted to a minimal set of individuals and is limited to what is necessary for support and operations. We do not routinely access your Customer Data.
During your subscription: We retain Customer Data for as long as your account is active. You can delete individual records, portcos, or reports at any time from within the Platform.
On account termination:
Data deletion requests. You may request deletion of specific Customer Data at any time by contacting us at info@rollforgeops.ai. We will process deletion requests within 30 days.
Legal holds. In limited cases, we may be required to retain certain data longer to comply with applicable legal obligations.
We use the following key subprocessors to operate the Platform. All subprocessors are contractually bound to maintain data confidentiality and security standards consistent with this Policy.
| Subprocessor | Purpose | Data Shared |
|---|---|---|
| Render | Application hosting and infrastructure. SOC 2 Type II certified. | All application data processed in transit |
| Neon | PostgreSQL database hosting. SOC 2 Type II certified. AES-256 encryption at rest. | All Customer Data stored at rest |
| Postmark | Transactional email delivery (invites, notifications, reports). | Email address, email content |
| Stripe | Payment processing. PCI DSS Level 1 certified. RollForge never stores card data. | Billing email, subscription status |
| OpenAI (via Polsia proxy) | AI-powered features: operations audit scoring, report generation, vendor matching. Data submitted is not retained for model training. | Customer Data submitted for AI analysis |
| ServiceTitan | Field service management integration. Only accessed when a customer explicitly connects their ServiceTitan account. Read-only access — RollForge does not write data to ServiceTitan. Credentials stored encrypted (AES-256-GCM) and never logged. | ServiceTitan jobs, revenue, and technician data for connected portcos only. Accessed only when the customer enables the integration. |
We will update this list when we add or change subprocessors. Material changes will be communicated via email with 30 days' advance notice.
RollForge is committed to achieving and maintaining enterprise-grade security standards. Our current compliance posture and roadmap:
For Enterprise accounts with specific compliance requirements (GDPR data processing agreements, custom security reviews, vendor questionnaires), contact us at info@rollforgeops.ai.
In the event of a confirmed security breach affecting your Customer Data, RollForge commits to:
We maintain incident response procedures and will provide ongoing updates as the situation develops following any confirmed incident.
Questions about this Policy, data deletion requests, or security concerns — contact us at info@rollforgeops.ai. We respond to all data-related inquiries within 2 business days.
Changes to this Policy. We may update this Policy from time to time. When we make material changes, we will notify you by email at least 14 days before the changes take effect. The "Last updated" date at the top reflects the most recent revision.
Also see our Terms of Service for the full contractual framework governing your use of RollForge.