Institutional-Grade Security, Data Provenance & AI Governance for General Partners
General Partners, IR heads, and Chief Compliance Officers require strict confidentiality around active fundraises, target LP shortlists, and anchor relationships. Prilago is architected so your proprietary fundraising strategy never leaves your tenant boundary and is never used to train external AI models.
1. Zero AI Training on GP Data
Your fund parameters, target check sizes, anchor LP inputs, saved pipeline shortlists, and Claude/Cursor MCP queries are never used to train, fine-tune, or enrich shared language models or cross-tenant recommendation graphs.
2. 100% Statutory & Public LP Provenance
All 123,580 LP records across 5,000 allocators are sourced exclusively from lawful public disclosures: state FOIA/OPRA responses, public pension ACFRs and board packets, IRS Form 990-PF/Schedule D, SEC Form ADV, DOL Form 5500, and NAIC Schedule BA filings. No scraped private GP datarooms or MNPI.
3. Strict Tenant Isolation & Read-Only MCP
Every GP workspace and fundraising pipeline is isolated at the PostgreSQL row level by authenticated user_id. Our Model Context Protocol (/mcp) server executes strictly read-only parameterized queries with scoped API keys (prl_live_*) that can be revoked in one click.
Technical Security & Compliance Controls
| Control Domain | Implementation on Prilago | Verification Status |
|---|---|---|
| Transport & Storage Encryption | TLS 1.2/1.3 (HSTS enforced) for all web & MCP traffic; AES-256 volume encryption at rest on AWS infrastructure. | Enforced |
| Session & Cookie Hardening | HttpOnly, SameSite=Lax, and Secure flags enforced on authenticated session cookies; Bcrypt password hashing & rate-limited authentication endpoints. |
Enforced |
| Webhook & SSRF Protection | Fail-closed HMAC token verification on inbound webhooks; strict outbound URL allowlisting blocking RFC-1918, loopback, and cloud metadata IPs (169.254.169.254). |
Enforced |
| Cryptographic Source Audit Trails | Every public source verification page (/public-source/[token]) is signed with an HMAC-SHA256 token tied to the exact commitment ID and field-level provenance record. |
Enforced |
| Vulnerability Disclosure | RFC 9116 compliant /.well-known/security.txt published; security reports triaged within 24 hours at security@prilago.com. |
Active |