Security & Responsible Disclosure

Security concerns and responsible-disclosure reports can be sent to info@gp-cap.com.

The machine-readable contact record is published at /.well-known/security.txt per RFC 9116.

We ask that reporters provide enough technical detail to reproduce the issue and refrain from accessing, modifying, or disclosing information that does not belong to them. We do not currently operate a paid bug-bounty programme.

Access to the GP Capital deal-room platform is invitation-only and permissioned. Counterparty access is granted on a per-deal basis according to role and explicit assignment, not by counterparty type alone.

• External access is controlled by the GP Capital internal team.
• Document visibility is governed by role and per-document permissions.
• Access may be restricted, time-limited, or revoked by the internal team.
• Internal accounts use multi-factor authentication; passkey sign-in is supported.

Materials shared via GP Capital deal rooms are confidential and intended only for the recipient. Counterparties are granted access according to their role and the relevant mandate; access does not constitute an offer of securities.

• NDA acceptance is required before counterparties can view deal materials.
• Where applicable, documents may be subject to preview-only controls, download controls, or watermarking — applied per-document at the discretion of the internal team.
• Document access events are logged for audit purposes.
• External redistribution requires GP Capital's prior written consent.

We do not claim that every document is watermarked or download-restricted by default. Controls are applied where the underlying counterparty or transaction requires them.

For broader review of how we operate the platform, the following public references apply:

• Privacy Policy — how personal information is collected, used, and retained.
• Terms of Service — terms governing use of the public website.
• Platform Terms — terms applicable to authenticated portal use.
• Disclosures — eligibility, jurisdictional restrictions, and conflicts.
• /.well-known/security.txt — machine-readable security contact record.

Aggregate, anonymised operational signals (e.g. recent system health) appear in the site footer when available. They are summary indicators and not a substitute for direct enquiry on a specific transaction.

For a fuller procurement / diligence overview — hosting, data retention, backup, incident response, and DPA — see the Trust Center.