How FUNDesk Keeps Your Book Locked Down

Last updated: September 2026

A book of business is merchant names, owners' SSNs, bank statements, and every deal you ever shopped. Here's what I did so it stays yours, in the order I did it.

The database refuses cross-workspace rows

Every FUNDesk workspace lives in one Postgres database, and every table that carries a workspace id has row level security forced on it. The connection tells the database which workspace it's acting for, and the database returns rows for that workspace only. If an application bug ever asked for another shop's deals, the database would hand back nothing. That's the second lock behind the application's own checks, and it's been fully on in production since July.

Sensitive fields are encrypted at rest

SSN, EIN, and date of birth are encrypted before they're stored. An SSN also gets its last four split out at the boundary, so a screen can show the last four without decrypting the whole thing. A person who is authorized to see the full value sees it. The database file, a backup, or a raw query doesn't hand it to anyone.

The AI can't enumerate them

I keep the sensitive fields out of the schema Agent Chat works from. It never sees SSN, EIN, tax id, date of birth, routing and account numbers, credit score, or internal margins as fields it could query. So "list the SSN on every merchant" has nothing to work with. The chat can read one record's fields only when the person asking already has access to that record, the same access the app enforces on every page.

Anything that writes, sends, or moves money asks first

Of the chat's 177 actions, 85 show a confirmation card with the exact arguments before they run. A member's chat sees that member's deals, and an admin's sees the team's. Which actions get a card is frozen in a test.

Outreach checks consent every time

Every email FUNDesk sends, from a rep, an agent, or a blast, goes through the same engines, and consent and do not contact are checked before every send. A held lead shows its reason.

Your data leaves with you

An owner can export the lead book to CSV from the pipeline (250,000 rows per file, so a bigger book takes a filter per file), and any object exports to CSV from its page. The lead export has its own permission key, locked to the owner until they grant it, because one file of the lead book is what a departing admin would walk out with. If you ever leave, you take the book with you.