Your cap table contains shareholder identities, ownership percentages, investor term details, employee compensation data, vesting schedules, and your company's complete equity history. It is arguably the most sensitive corporate document your startup maintains.
And yet most founders have never asked a simple question: who actually owns this data — you, or the platform you store it on?
What Happened With Carta in January 2024
In January 2024, the CEO of Linear (Karri Saarinen) publicly revealed that a salesperson from Carta's liquidity solutions team had contacted a Linear angel investor about selling their shares. The investor was a family member who had never publicly disclosed the investment. Linear had never authorized Carta to facilitate a sale.
The implication was clear: someone at Carta had accessed Linear's confidential cap table data and used it to generate sales leads for Carta's secondary market business. Saarinen reported that seven other Linear investors received similar outreach, and ten other companies reported the same experience.
Carta's CEO Henry Ward responded by shutting down Carta's secondary trading business entirely, stating that the company would "prioritize trust." The secondary business accounted for approximately $3 million of Carta's $250 million in annual revenue.
The incident raised a fundamental question for every startup on Carta's platform: if your cap table provider has a secondary business that profits from brokering trades in your investors' shares, are their incentives aligned with yours?
The Question Founders Should Be Asking
Data ownership is not a feature checkbox. It is a structural question about your vendor's business model.
When evaluating a cap table provider, founders should ask: Does the platform make a contractual commitment to data ownership — not just a privacy policy, but a legally binding clause that your data will not be used for purposes beyond serving you? Does the platform operate any adjacent businesses (secondary markets, fund services, 409A valuations) that create an incentive to access or monetize your data? Can you export all of your data at any time in standard formats without contacting support? Can you cancel your account without calling anyone?
Most cap table providers do not have explicit contractual data sovereignty commitments. Their terms of service typically grant the platform a license to use customer data in broad terms that could include analytics, product improvement, and business development.
What Data Sovereignty Looks Like in Practice
Data sovereignty means the platform treats your data as your property, not as a business asset. In practice, this means a contractual commitment — not a privacy policy, not marketing copy, but a binding legal clause — that your cap table data will never be used to broker trades, contact your investors, or monetize your equity information in any form.
It also means full data portability: the ability to export your complete cap table in standard formats (OCF, CSV, Excel, PDF) at any time, without restrictions or fees. And it means self-service cancellation: the ability to end your relationship with the platform without negotiation or support calls.
DealCycl was built by enterprise security and governance veterans specifically to provide this level of data protection for startups. Chris Goodwin (CEO) was the lead architect of RSA Archer and co-founded Lockpath. Chris Caldwell (COO) co-founded Lockpath, a GRC platform acquired by NAVEX Global. The same standards that protect financial data at the world's largest institutions now protect your cap table.
DealCycl makes a contractual commitment to data sovereignty: your data will never be used to broker trades, contact your investors, or monetize your cap table. This commitment is legally binding and applies to every plan, including the free Founder plan.
Five Questions to Ask Any Cap Table Provider
Before trusting your cap table to any platform, ask these questions. If the answer to any of them is unclear or unsatisfactory, consider what that says about the vendor's priorities.
Does the vendor make a contractual (not just policy-level) commitment that my data will not be used beyond providing services to me? Does the vendor operate secondary market, fund administration, or data analytics businesses that use customer cap table data as an input? Can I export my complete cap table in OCF, CSV, Excel, and PDF formats at any time? Can I cancel my subscription without calling support or negotiating with a retention team? Does the vendor publish its pricing, or do I need a sales call to find out what I will pay?
Explore DealCycl Company → | Read: Cap Table 101 | See: DealCycl vs Carta | See: Carta Alternatives