Security
Security designed for other people's money
Common Ridge stores investor identities, bank details and tax documents for many funds in one system. Isolation, authentication and audit are designed first and tested continuously. The full list of controls is on the trust page.
Sign-in
There are no passwords. Investors and staff sign in with passkeys, an emailed link bound to the requesting device, Google, and an authenticator app as a second factor. Staff must enroll a strong factor before first use, and a fund can require passkeys for its investors.
Step-up
Sensitive actions require a fresh strong-factor check within five minutes: viewing or changing bank details, signing, downloading tax documents, changing an email, adding or removing a factor, granting access and approving money movement.
Isolation and audit
Every tenant table carries a tenant identifier, enforced by database row-level security, an application-layer guard and a continuous test that two tenants can never read each other's rows. Security-relevant events go to an append-only, hash-chained audit log that fund owners and auditors can export.
Roadmap
SOC 2 is on the roadmap. We state what we do today on the trust page and do not claim a report we do not have.
See it with your own fund structure
Book a walkthrough, or start a trial and explore a workspace yourself.