From the company’s own pitch deck to a scored Deal Package.

The pitch deck first. Zoe turns it into a Claim Ledger: a list of every claim the deck makes, one per row. Each claim is then checked against the systems the company connects. Other data-room files (PDFs or spreadsheets) are optional extra evidence.

Where the deck and the company’s systems disagree, or where the systems say nothing, Zoe writes the questions. You hold one call with the company contact and upload the transcript. Zoe marks each answer as answered, dodged, or contradicted by the evidence, and the results feed the Deal Package.

A Deal Package holds the Zoe Score across nine dimensions of operating health, the findings and how to read them, an IC memo written for your investment committee, a signed opinion when the evidence is strong enough, and an evidence appendix. You can also export the files you need for your IC pack.

Zoe runs on partial data. Any one connected system produces a useful Deal Package, and each extra system sharpens the dimensions it feeds. A missing source is never hidden: the dimensions that depend on it are marked as reduced coverage, and the overall score is stated with its coverage. The Zoe Score carries a confidence percentage and a coverage tier, and Zoe signs the opinion only when confidence clears the bar. Gaps in the Claim Ledger also become questions for the Company Call.

Each diagnostic sits in the customer’s workspace, data is encrypted in transit and at rest, and sensitive fields are also encrypted with AES-256-GCM. The company accepts a DPA (data processing agreement) before connecting anything, and the acceptance is recorded. Zoe stores synced records and diagnostic evidence; delete the workspace and Zoe deletes its data from Zoe’s active systems and revokes its grants, except the records /privacy lists. See /security for the detail on each connector.

No, and that is by design. Zoe sends the company a secure link. Whoever holds the keys there (often the CEO, CFO or an admin) accepts the DPA and connects each system, logged in as themselves. Zoe only reads, though the permission a provider grants can be broader than what Zoe reads. Disconnecting a system stops future reads, and Zoe also asks the provider to revoke its access. You never hold a password. Most investors run Zoe as a condition of moving to a letter of intent, the same way a quality-of-earnings review is.

Connected systems are read for patterns: who communicates with whom, how often, how fast. In Slack, Zoe also reads message text and scores it for sentiment, leadership alignment and psychological safety, with personal identifiers stripped first, then drops it before storage: message bodies are never stored, and DMs are skipped. From GitHub, Zoe reads commit timings, pull requests with their titles and descriptions, and releases with their notes, never file contents or diffs, though the permission GitHub grants can be broader than what Zoe reads. The documents you add to a diagnostic (the pitch deck, any data-room files) and the Company Call transcript are read in full, because that is what the claims are checked against. Every connector’s exact boundary is listed on /security.

About 90 days of history in its systems. Zoe needs enough activity to read patterns reliably. Younger than that and the confidence on the score gets too low to act on.

Yes, by running the diagnostic again. Portfolio monitoring is planned. It is not available today. Investors typically run one before the letter of intent, again at close, and quarterly after close. Operators run one quarterly to see whether their fixes are landing.