Investor portal security checklist
What LPs' security teams ask about, and the answers you want to be able to give.
What security should an investor portal have?
Encryption in transit and at rest; SSO and enforced multi-factor authentication; permissions down to the document; protected wire instructions; a complete audit trail of views and downloads; documented hosting, backups and incident response; and the same controls in the mobile app.
Identity
SSO for the GP team, MFA for everyone, session limits, and prompt removal of departed users.
Permissions
By fund, vehicle, investor, contact and document. Side-letter recipients see their letters; nobody else does.
Wire protection
Wire instructions published only in the portal; changes verified out-of-band.
Evidence
Audit trail, penetration test summaries, policies under NDA, and prompt DDQ answers.
Mobile
The app should enforce the same permissions and session policy as the web.
Questions
Does FUN/D answer DDQs?
Yes; see security.
Want to see this on your own fund?
Name and work email. A person replies within one business day, usually with times for a demo on a structure like yours.
Talk to us
Name and work email. We reply within one business day, from a person.
Sent.
Someone from FUN/D will email you within one business day. If it's urgent, call +1-212-658-0862.