For the company being read
An investor asked you to connect Zoe. Read this first.
This is one of the lighter asks you will get in a diligence process, and one of the fastest. A few connections, one call, and the investor has what they need. Here is what you accept before anything connects, what Zoe reads, what she can’t, and what you keep control of. Written for you and your security or legal reviewer.
- 01
Message bodies are never stored.
From the systems you connect, Zoe reads the shape of activity: who talked to whom, how often, how fast, and when that changed. In Slack, message text is scored and then dropped before storage, and DMs are skipped. Not one line of source. The one exception is what is placed in the diagnostic on purpose: your pitch deck, any data-room files, and the Company Call transcript, which Zoe reads to build and test the Claim Ledger.
- 02
You accept it. You grant it. You revoke it.
It starts with a signed link from the investor. You are shown the DPA before anything connects, and your acceptance is logged as a consent event you can point to later. Every connector is then a separate OAuth grant you make in your own session. Zoe only reads, though the permission a provider grants can be broader than what Zoe reads. Disconnecting one stops its reads without breaking the others, and Zoe also asks the provider to revoke its access. Credentials never leave your systems.
- 03
Stored, then deleted with the workspace.
Zoe stores synced records and diagnostic evidence. Disconnecting stops future reads; records already synced stay stored. When the investor deletes the workspace, its data is deleted and its grants revoked.
In one look
From your systems: the shape of activity, and what is never stored.
Zoe reads from your systems
- Who talked to whom
- How often, and how fast
- When that changed
Zoe never stores from your systems
- Message bodies
- Documents
- Source code
Before you connect
A checklist for your security reviewer.
- 01
Open the signed link and read the DPA
The invite comes from the investor through Zoe. The DPA is shown before anything connects, and your acceptance is logged as a consent event on the diagnostic.
- 02
Confirm which connectors are in scope
You choose. A diagnostic runs on four of six sources as readily as six of six. Coverage is reported rather than assumed, and the score carries a confidence percentage and a coverage tier.
- 03
Have your admin make the grants, not the investor
Each grant is an OAuth consent from your own admin console, in your own session, and Zoe only reads. Credentials never move and the investor never sees one.
- 04
Read the per-connector table with your reviewer
One canonical page lists what Zoe reads, what she never stores, retention, and revocation for each source, plus how the deck, data-room files and call transcript are handled.
- 05
Note the Slack line explicitly
Message bodies are never stored. If your counsel needs that in writing beyond this page, ask and it goes in the agreement.
- 06
Expect the Company Call
Once your books are connected, Zoe checks the deck against them and turns the gaps into questions. Your CEO or CFO answers them on a call with the investor; the transcript is scored as answered, dodged or contradicted. Prepare for it like an IC.
- 07
Agree what happens at close
Closing the diagnostic deletes nothing. Agree when the investor will delete the workspace, which deletes its data and revokes its grants.
- 08
Keep the revocation path open
Any connector can be withdrawn mid-run without breaking the others. The Deal Package then states reduced coverage.