Security & privacy
How we protect what you share with us.
We hold sensitive personal and financial information. Here is how we protect it, described plainly, and what you can do too.
Access and authentication
Invitation-only access
Accounts can be opened only with a valid, personal invitation code. Codes can be limited to one email address, capped in use, set to expire, and revoked.
Passwords we never see
Sign-in is handled by a dedicated authentication provider. Passwords are stored only in hashed form, never as plain text, so we cannot read yours even if we wanted to.
Every application reviewed by a person
No account is approved automatically. A member of our compliance team reviews each application, and its identity documents, before access opens.
Data protection
Identity documents kept private
Your photo ID and proof of address are held in private storage, never public. They can be opened only by you and authorised compliance staff, through links that expire after a few minutes.
You see only your own data
Access is enforced in the database itself, not just the website. An investor account can read only its own holdings, transactions and documents. Administrative functions are restricted to authorised staff.
Encrypted in transit and at rest
Connections to the platform are encrypted, and data held in our database and storage is encrypted by our infrastructure providers.
Operational controls
Every administrative change is logged
Approvals, assignments, edits and removals made by our team are written to an audit log with who did what and when, so nothing changes without a trace.
Established, monitored infrastructure
The platform runs on established cloud infrastructure providers, rather than servers we manage ourselves, and inherits their operational and physical security controls.
Kept up to date
The software the platform is built on is kept current, so known issues in underlying components are addressed as they're fixed.
No advertising or tracking
We don't sell your data and we don't run advertising or third-party analytics on the platform. The only cookies we set are the ones needed to keep you signed in.
What you can do
- Use a long, unique password for your RockLake account, not one reused from another site.
- Check the address bar reads rocklakecapital.com before you sign in, especially if you followed a link from an email.
- We will never ask for your password by email, phone, or in a support message. If someone does, it isn't us.
- Sign out of the client portal on any device you share with others.
Reporting a security concern
No system is perfectly secure. If you believe you've found a vulnerability, or that your account has been accessed without your permission, email ir@rocklakecapital.com straight away, with enough detail for us to reproduce or investigate what you found.
If you report a genuine issue in good faith, and don't access, alter or share data beyond what's needed to demonstrate it, we won't pursue action against you for the report itself. We aim to acknowledge reports promptly.
Regulation and data protection
RockLake Capital is based and regulated in the Cayman Islands, and processes personal data in line with the Cayman Islands Data Protection Act. Read our Privacy Notice for what we collect and your rights, our Regulatory Information, and our Conflicts of Interest Policy.
RockLake is by invitation only.
Have an invitation code? Open your account. If not, request one and we'll be in touch.