Controlled access should collect only what it needs.
SwiftOPSA separates public browsing, investor-interest requests, investor credentials, and operator credentials into different states and stores.
Investor access requests
When you request controlled investor access, Willoway may collect your name, email address, organization, role, area of interest, and the message you provide. A public request does not automatically create an account.
Credentials
Approved investor accounts use password hashes rather than stored plaintext passwords. Temporary credentials are generated for handoff and must be replaced before protected briefing content is exposed.
Security and abuse prevention
The public access workflow uses rate limiting, anti-automation controls, authentication lockout, and audit records. Rate-limiting identifiers are stored as keyed hashes rather than raw IP addresses.
Retention
Unapproved pending or declined investor requests are eligible for automated retention cleanup after the configured retention period, which defaults to 90 days. Audit events may be retained longer to preserve security and governance history. Approved account records are retained while access remains operational or as reasonably necessary for security and business records.
No investment rights created
Submitting a request, receiving access, or viewing investor materials does not create any ownership right, commitment, allocation, offering right, or entitlement to participate in financing.
Contact and correction
Use the investor access process to request correction or closure of an investor-access record. Operators can suspend or revoke accounts and run the configured retention process.