What Vantage is and how it works

Three kinds of account

• Founder — belongs to one or more companies. Sees everything about their own company and nothing about anyone else's.
• Investor — holds positions in companies. Sees each one only to the extent the founder has allowed, and can run a fund with its own limited partners alongside.
• Platform admin — the operator's own console: every user, every company, and the activity log. Not a customer role.

Sign-in is by email and password. The demonstration build offers the founder and the investor as one-click logins so a visitor can move between the two sides of the product and see how differently the same company looks. The admin is not offered: it is the operator’s own account, and visitors are steered to the two sides that are the product.

Report the month

Six figures make up a period: monthly recurring revenue, total revenue, burn, runway, headcount and net churn. They are entered by hand, one period at a time, and every chart and grade in the product is derived from them — nothing on the founder dashboard is decorative.

Publish an update

An update carries a written summary, a list of wins and a list of risks. When it is published, the figures for that period are copied onto it and frozen. Revising the numbers afterwards does not change what the update said — that is the difference between a record and a dashboard.

The founder can see how many investors have opened each published update. Opening it twice does not count twice.

Investors can comment on an update, and a comment is visible to everyone who can see the update — there is no private-comment option. There used to be one, and it created a message addressed to the founder that lived on an update rather than in a conversation, which is exactly where nobody looked for it. Anything private belongs in a room. Each update shows how many comments it has, counted under the same visibility rule the thread uses, so the number never advertises a comment the reader cannot open.

Run a data room

Documents are uploaded under a category, optionally behind a non-disclosure agreement the investor must sign before opening anything. Every download is recorded in the activity log, so a founder can see who took what.

Marking is honest about what a file format can carry. A PDF or an image gets the watermark proper — the same diagonal stripes the in-app preview shows, plus a line naming who received that copy. A spreadsheet, a text file or a Word document cannot hold a diagonal mark at all, so it gets a provenance stamp instead: a line naming the company and the recipient, which makes a leaked copy traceable but does nothing to deter one. The vault labels each document with which of the two it will get, and the activity log records which was applied. They are not the same thing and the product no longer says they are.

Decide what each investor sees

A founder shares the workspace area by area. There are nine: financials, documents, hiring, projects, updates, meetings, collaboration, calendar and the org chart. Two more — the overview and risk intelligence — are outside the choice, because every linked investor reaches those whatever else they are given.

The access level is a description of those boxes, never a setting beside them. All nine shared is full access. Exactly updates, the org chart, and collaboration is guest access. Anything else is custom access, which a founder cannot choose: it is what full becomes when an area is withdrawn, and what guest becomes when one is added. Deriving the label rather than storing it means the word on the row can never disagree with the ticks in it, and the server recomputes it on every write, because a request can arrive with any pairing of the two.

Guest access is not an abridged version of everything. It is five pages: the overview, risk intelligence, the updates the company has published, the org chart, and the conversations. No data room, no cap table, no project board. Conversations are in the set because talking to someone is not the same kind of thing as handing them financials: before they were, a founder could write to a guest, name them and notify them, and the guest had nowhere to read any of it. Financials are not in the set, so a guest sees no figures at all: every metric reads “Restricted”. An investor given financials on custom access sees the headline ones a founder would put in a monthly update anyway — recurring revenue, total revenue, runway and headcount — with burn, churn and anything custom withheld; full access sees everything. The line a guest reads about their own access is built from the same definition, so it cannot go on describing an older version of it.

Changes are staged and saved together. Ticking a box used to write immediately, so moving one investor to a custom level meant seven separate writes and seven chances to leave them half-changed; the row now shows what it will become and one Save commits it. The investor's sidebar and tabs are built from the same nine flags, so what a founder ticks is what the other side can reach — not a second list that can drift from the first.

This is enforced behind the page, not by hiding things on screen. A page is handed only what its viewer may see, so withheld figures never reach the investor’s screens, and the menu is never mistaken for the lock: arriving at a forbidden page by typing its address lands on the overview, and the endpoints behind those pages check the level themselves. In this demonstration the code behind the pages runs inside the visitor’s browser, and the whole demo database is stored there too, so the rule governs what the product shows rather than what a determined visitor could dig out of the browser’s storage. It is the same code a server would run.

Model what happens next

Two planning tools. A runway simulator projects eighteen months of cash against a growth rate, an overhead change and any hires being considered. A dilution model works out what a priced round does to everyone's ownership, including the option pool. Both are real arithmetic on the company's own figures, and scenarios can be saved and reloaded.

Know before you are late

Reporting carries a grade that falls as updates slip. The founder is warned before that happens rather than after — “publish before the cycle closes to hold your AA grade” — with one click into the composer. Nothing appears at all while reporting is on time. A milestone past its due date reads Overdue everywhere it appears — the project board, the overview, the board pack — rather than keeping an “On track” it was given before the date passed. Overdue is always red — a late milestone, a late update, a capital call past its date — so lateness reads the same wherever it appears; brass is kept for what is only at risk, due soon, or not yet started.

Answer what investors ask

When an investor asks for something specific — the assumptions behind a runway figure, the hiring plan — it arrives as a request with a status, not a line in a log. Answering it closes the request and the answer goes back to them. Open requests are counted on the founder’s overview.

Hold a meeting, and know who is coming

A meeting carries a time, a timezone and an agenda, and goes either to the whole investor group or to named people only. Naming people is what makes it answerable: each of them can accept or decline, and the meeting centre shows the founder who was invited, who has accepted, who has declined and who has not replied yet.

A meeting limited to named investors is filtered before it reaches the page. It never reaches the page of someone who was not invited, so a board-only session is not discoverable through the product by anyone else on the cap table.

See the month, not just the next thing

A calendar of every meeting the company holds, on a month grid, alongside the list of what is coming up. It opens on the month containing the next meeting rather than on today, because an empty current month reads as “nothing scheduled” when there is something a fortnight away. Selecting a meeting shows its agenda, its audience and who has replied. It is deliberately read-only — scheduling lives in one place, not two. The “Coming up” card on the overview opens the calendar on the month of the meeting chosen, with that meeting selected and the calendar brought to the top of the screen.

Publish an org chart

Who works at the company, as a tree, with the seats it is hiring for marked HIRING in place of a name. People are stored as text rather than as accounts: almost nobody on an org chart will ever have a login here, and requiring one would make the feature useless to the company it describes.

The founder adds people, sets reporting lines, and flips a seat between filled and open. Removing a manager removes the branch below them — that is what removing a person means on a chart — and the dialog says so before it happens.

This is the widest read permission in the product: every investor can see it, at any access level. Who runs a company and where it is growing is the kind of thing a company publishes on its own careers page, and it is much of what a guest is trying to learn. The founder is told as much on the page, before they type a colleague's name into it.

Produce a board pack

A printable document covering the month's numbers and their movement, the reporting history behind them, the cap table, the update that went out, and what the team is hiring for and working on.

See the whole book at once

Total invested, current value, average runway and open risk warnings across every active position. A position with no valuation on it is carried at what was paid for it, so the total never shows a gain nobody has recorded.

Mark and exit positions

Each position takes a current valuation and, when it closes out, an exit with proceeds. Value and multiple appear on the card, in the portfolio total, in the export and in the report to limited partners. A mark belongs to the investor's own book — the founder cannot see or set it.

Compare companies side by side

One sortable table across the portfolio. Where an investor's access is limited, the cell says so rather than showing a blank or a zero.

Watch for trouble

The risk centre flags short runway, late reporting and objectives that have slipped, and writes each one as a sentence rather than a threshold breach. A company under six months of runway is told a raise must already be underway; one with twenty months is told it has room. Each area carries a score from 1 to 10, where lower is better, and a legend above the cards gives the three bands — low, medium, and high — in the same colours as the cards, so the number is explained before a reader meets it rather than behind a hover nobody can reach by keyboard or touch.

Find things

Search across company, sector, round and tag. The tags an investor files a position under are chips that filter the grid. The default order is “needs attention”, ranked by the same signals the risk view uses, so the two cannot disagree about which company is the worry.

See what changed

Returning to a company shows what has arrived since the last visit — updates published, documents added. Nothing on a first visit, because everything being new is the same as nothing being new.

And when a company stops reporting altogether: if a founder archives the workspace, the position is marked as archived on the portfolio card and the company page opens with a banner saying every figure below it is the last reported state. Frozen numbers presented as live ones is the worst thing a page like this could do quietly.

Ask for something specific, and be told when it is answered

Rather than a generic nudge, a request names its subject and can carry a question. The founder sees it, answers it, and the answer comes back here. One open request per subject, so repeated asking cannot bury anyone.

When the founder replies, it reaches the investor rather than waiting to be found: the reply appears in the notification bell, quoted in full. The two sides need different machinery for this. A founder's open requests leave their own count the moment they answer, so nothing has to be stored; an answered request stays answered forever, so the investor's side records when they read it, and a founder editing a reply marks it unread again. A correction the reader never sees is worse than no correction.

Talk in rooms, with exactly the people in them

Every conversation on a company is a room, and a room is its participants. There is one company-wide room, called Everyone, and any number of rooms that founders and investors make themselves — with one other person or several, guests included, named or left to be listed by who is in them. Anyone in a room can rename it. They all sit in one row of names at the top of the page; there are no tabs, because “shared chat” and “private chats” were the same thing at different audiences presented as two features.

The line under the room names its audience in full — “You, Elena Rodriguez, and Noor Haddad” — rather than asserting that “everyone” can see it. That claim was false the moment one investor was on guest access, and a sender reads that line to decide what is safe to post.

Everyone is governed by the collaboration area: a founder who withdraws it closes the room to that investor in the page, in the endpoint behind it, and in their notifications. The other rooms are not governed by it, deliberately. A room is between the people in it, and someone shut out of the company room must still be reachable one to one, or the product is talking at a person who cannot answer. Membership is checked on every path — listing rooms, reading one, posting to one.

Find everything said to you

The inbox collects everything addressed to a person across every company they belong to — conversations, comments on updates, comments on milestones, and requests — newest first, each naming its company and where it lives, and each opening the exact place it was said: the message in the room, the message in its private conversation, the comment on an update or a milestone, or the request, scrolled into view and briefly highlighted so nobody has to hunt for it. A message left on an update opens that update with its thread expanded, not the general room.

The notification bell keeps its history. Reading one notification no longer empties the list; new ones are marked, read ones stay, and the count on the bell is only what is new. Both the bell and the inbox are built from one definition of what counts, so they cannot disagree.

A notification obeys the same permissions as the thing it is about. It carries an excerpt, so a notification about a room someone cannot open would hand them its contents — and three times that was happening, while every page was correctly locked. A message in a room reaches only the people in that room. An investor is told only about the comments on an update that the update itself shows them, so the older private comments other investors left stay out of the bell and the inbox.

See the whole portfolio's diary

One calendar carrying meetings from every company an investor holds, colour-coded by company, with a filter to narrow it to one. Where access or the meeting audience means a company's diary cannot be shown, the calendar says which company it is leaving out rather than quietly presenting a thinner month as the whole picture. The “Coming up” card, shown on the Portfolio tab only, opens it on the meeting chosen in the same way as the founder's.

Run a fund

A fund holds limited partner commitments and issues capital calls, allocated across the partners in proportion to what they committed. Payments are recorded against a call as they arrive, so it reads as partly paid, paid, or overdue once its due date passes. The platform records the call; in this demonstration build it does not contact anybody.

Report to limited partners

A printable portfolio report: deployed capital, current value and multiple, average runway, a per-company benchmark and the latest narrative from each. It reads from the same definition of “the portfolio” as the dashboard, so the two cannot disagree.

This is the section most product specifications leave out. Everything below is a real limit of this build, stated plainly.

• There is no server. Vantage is published as a static site: plain files that any web host can serve. The database, the code behind the pages, and sign-in all run inside the visitor’s own browser, and the demo data is stored there. Every visitor starts from the same demo data, which ships with the site as a public file, and gets a private copy of it. Nothing one visitor does reaches anyone else; the two sides of a company meet by signing in to both accounts in the same browser. The copy survives closing the browser and stays until the visitor resets it (Settings → Demo data → “Reset demo data”) or clears the site’s data. When a new version of the site changes the demo data, every visitor’s copy is replaced and they are signed out. Because the whole database is in the browser, sign-in and the non-disclosure agreement are illustrations of the product rather than security: anyone can read the demo data, and every figure in it is invented.
• No AI models run. Several screens are shaped around model output — meeting preparation, a portfolio assistant, risk narratives. In this build they return prepared responses. Nothing calls a model and nothing spends an API key. The code that would make a live call is not part of the site, so turning it on would take a change to the code, not a setting.
• Sign-up is closed. The registration route refuses every request while demo mode is on, and demo mode is fixed on when the site is built, so there is no setting a host could change to reopen it. The page says so before anyone types rather than after: it carries no form, only the way back to the two demo sign-ins. Nobody accumulates an account here.
• Pricing is gone. Subscription plans and investor tiers were removed with the pricing page. Nothing in the product is gated behind a price, and no feature is dimmed to advertise one — a locked panel a reader cannot buy their way past is a broken feature wearing a badge.
• No email is sent. Invitations, update notifications and shared agendas produce a link and a log line. Nothing leaves the visitor’s browser.
• Documents are not encrypted at rest. Access is controlled, and downloads are marked and logged — but the files themselves are stored as they are. A document a visitor uploads stays in their own browser’s storage, and the ten sample documents in the demo data are public files that anyone can fetch by their address. The homepage used to claim otherwise; it no longer does, and the company page's badge says “Access controlled” — which is what it describes — where it once said “Vault Secure”.
• A provenance stamp is not a watermark. Spreadsheets, text files and Word documents cannot carry a diagonal mark, so they get a line naming the company and the recipient instead. That makes a leaked copy traceable; it does nothing to deter one, and in a text file a single deleted row removes it. The product labels the two differently and the activity log records which was applied, because calling them the same thing was the overstatement that prompted the distinction.
• The org chart is a drawing, not a directory. The people on it are names typed by a founder, with no account, no email and no link to anything else in the product. Marking a seat as hiring does not create a role on the hiring board, and closing a role does not fill a seat — the seeded charts match the seeded vacancies because they were written to, not because anything keeps them in step.
• The four company security switches are stored preferences — multi-factor, login alerts, IP restriction and watermarking. They record an intent. Only watermarking currently changes behaviour.
• Ledger integrations are not connected. QuickBooks, Stripe, Xero and Plaid appear as a surface. No data flows.
• The activity log is not certified anything. It records who did what and when, across roughly two dozen kinds of action. It is a useful record, not a regulated one, and it deliberately stores no IP address while the build is in demonstration mode.
• Every figure is invented, and one company is not. The rounds, the numbers, the cap tables and the people are synthetic throughout, and the platform says so on entry, in the header of every signed-in page, and in the footer. The exception is Teaching Garage, which was a real business — digital STEM curricula for K–6 classrooms, no longer trading, its curriculum now in the public domain — and appears here as a work sample. Its profile says which half is which: the company is real, the funding round and financials around it are not.

The stack, briefly

• Next.js 16 with the App Router, running on React 19, exported as a static site: plain files that any web host can serve, with nothing running on the server. Every page renders in the browser and loads its data there.
• An in-browser host in place of a server. One background worker, shared by every open tab, runs the database, the app’s own request handlers, and sign-in, so the pages ask it for data exactly as they would ask a server.
• PostgreSQL through Prisma, with thirty models covering users, companies, positions, permissions, documents, updates, meetings and their replies, org charts, syndicate conversations, funds and the activity log. The database is Postgres itself, compiled to run in the browser, and it is kept in the browser’s own storage.
• NextAuth for sign-in, with passwords hashed and the session kept in the in-browser database, shared by every tab.
• Tailwind CSS 4, with the palette and the shared table, button and dialog recipes defined once rather than per page.
• Recharts for every chart.

Decisions worth naming

• Permissions are enforced behind the page, not on it. They were once applied by the screen itself, after the data had already arrived. That was rebuilt, so each page is handed only what its viewer may see. With a server, that keeps withheld data off the viewer’s device altogether; in this static demonstration the whole database is in the browser, so it governs what the product shows.
• “The portfolio” is defined in one place. Five surfaces once computed it independently and disagreed — the report to limited partners overstated deployed capital by half a million against the dashboard. One module now answers the question.
• Published figures are copied, not referenced. A record of what was reported has to survive the numbers being revised.
• Native browser dialogs are gone. Every confirmation states what will actually happen rather than asking “are you sure?”.
• A menu is not a lock. Hiding a tab is a courtesy to the reader, not a permission. Every surface that a tab list withholds also refuses the request behind it, because the two get out of step: a warnings panel once told a guest-access investor about a milestone on a page that does not exist for them, and a meetings endpoint once answered anyone on the cap table regardless of level.
• A notification is a permission surface. Pages were locked correctly while the bell delivered excerpts of what they withheld. Every notification source now resolves its audience by the same rule as the surface it describes — the permission area for company-wide content, membership for rooms.
• Prepared content is revealed by its date. The demonstration data runs ahead of the calendar so the product is current whenever someone looks at it. Anything dated in the future is not read at all — enforced once, on the one database client every part of the product uses, rather than on each screen — so a month’s figures appear when the month has happened and never before. “Today” is the visitor’s own clock, and the later rows are in the demo data from the start; they are simply never shown early. A figure shown as reported before its period has ended is exactly the kind of claim this product exists not to make.
• What a notification needs depends on which way it points. Some counts clear themselves — a founder's open requests leave the count when answered. Others do not, and those need a stored read-marker or they either never appear or never go away. Both kinds now exist and they are built differently on purpose.

Institutional Sovereign

A near-black ground with a single accent, chosen so that financial data reads as the subject rather than the decoration.

• #0B0F19 Midnight Slate — the page
• #161D30 Navy Slate — cards
• #0D9488 Spruce Teal — the only accent; every action and active state
• #F1F5F9 Ice Platinum — headings and primary text
• #1E293B / #64748B — borders, dividers and fills
• #94A3B8 Slate Muted Text — labels, captions and secondary text
• #D06A5F Signal Clay — loss and error
• #C9954A Muted Brass — caution

Chart series are tints of the accent rather than transparencies, because transparencies collapse into each other on a near-black ground. Numbers are set in a tabular face so figures stack down a column. The logo is fixed: never animated, recoloured or altered.

Written in one voice

Database values never reach the screen — a capital call reads “Partly paid”, not PARTIALLY_PAID. Icons are line drawings that take the colour and weight of the text beside them, not emoji. Empty states explain rather than apologise. Where the product cannot do something, it says so in the same plain language as everything else. The top bar names the page you are on, not your role. The voice reaches past the product's edges too: a shared link previews with the headline and a card in the platform's own palette, and a mistyped address or a page that fails to load lands somewhere in the same voice with a way back, not on the framework's default.