4 ms·

Linear CEO alleges Carta mishandled sensitive cap table data

152 points by hubraumhugo 3y ago

jamestimmins 3y ago
This response by the CEO of Carta is pretty appalling, as it doubles down on an existing breach of trust. The response itself may actually do more reputational damage than the original "mistake".
- 23B1 3y ago
  Don't forget how poorly he handled the harassment claims last year. This is now a pattern.
- casperb 3y ago
  I think you refer to this response? https://x.com/henrysward/status/1743794996732735679 https://x.com/henrysward/status/1743794996732735679
  - jamestimmins 3y ago
    Yeah, thanks for including that
  - manthanf1 3y ago
    https://nitter.net/henrysward/status/1743794996732735679 https://nitter.net/henrysward/status/1743794996732735679 For context, parent, replies without signing in:)
- dang 3y ago
  Discussed here: Carta CEO's response to the unsolicited outreach to their customers' investors - https://news.ycombinator.com/item?id=38897363 https://news.ycombinator.com/item?id=38897363 - Jan 2024 (77 comments)
simonw 3y ago
I liked Dare Obasanjo's take on this one: https://twitter.com/Carnage4Life/status/1743579253176930641 https://twitter.com/Carnage4Life/status/1743579253176930641 > Every startup plays fast and lose with user privacy until they have a come to Jesus moment which marks their transition into becoming a big company. > That Carta’s sales teams use the private data in your cap table to nag your investors to sell their shares should be that moment.
- jamestimmins 3y ago
  But is this really true? In my experience, it's been less of a "come to Jesus" moment and more a slow process of hiring experienced folks who understand the appropriate privacy/security posture for a growing company. Edit: I'm yet to experience (or see) it as a public breach of trust, especially when the company already has thousands of employees.
  - cowthulhu 3y ago
    "Dragged to Jesus"
- seanieb 3y ago
  * they’re not just using that private information to nag you. They appear to be abusing their access to confidential information to price it for the buyers too.
- whateveracct 3y ago
  One of my unofficial roles as technical cofounder was to bring some ethics regarding customer data and privacy. If I could build the software in a way that (ab)using PII or otherwise private data unnecessarily was difficult, even better. Business types understand when things are too expensive to build ;) Not saying business folks never have good ethics regarding that stuff, but I find engineers are often more opinionated about it.
deleted 3y ago
[deleted]
casperb 3y ago
Two more examples in this thread: https://x.com/anothercohen/status/1743807313306140809 https://x.com/anothercohen/status/1743807313306140809
- seanieb 3y ago
  There’s examples going back years to when they released the third party sales product, CartaX. Funnily there were internsl signs that there were problems with this product before it launched: “Andrea Walne, Carta's head of liquidity solutions, was pushed out after she raised concerns about regulatory compliance [of CartaX].” - https://www.nytimes.com/2020/08/30/business/carta-workers-inequality.html https://www.nytimes.com/2020/08/30/business/carta-workers-in...
threeseed 3y ago
This is also being discussed here: https://news.ycombinator.com/item?id=38897363 https://news.ycombinator.com/item?id=38897363
hubraumhugo 3y ago
Are there any open-source cap table management alternatives?
- milkglass 3y ago
  Let's do it and call it Cartb
  - deleted 3y ago
    [deleted]
- hackernewds 3y ago
  I would not trust the open source community with this private data. the potential for abuse is too distributed without practical access controls.
  - mkl 3y ago
    The software would be open source, not the data. You'd probably run it on your own server/VPS, and just give appropriate people access.
- paulgb 3y ago
  You could just use a spreadsheet. The reason I pay for cap table management software is that it’s the easiest way to get a 409(a) valuation, which is something pretty much every US startup needs annually and open source couldn’t replace. (I looked at getting a 409(a) valuation separately and the best prices were more than cap table software that bundled one.)
- ugh123 3y ago
  spreadsheets
seanieb 3y ago
It appears as if they didn’t just mishandle the data, but also used that data to help investors price their offers based on several confidential factors.
- monkeybusi 3y ago
  [dead]
- Simon_ORourke 3y ago
  Is there anything the SEC could intervene with on that particular allegation - I mean, it's more-or-less insider trading right?
  - seanieb 3y ago
    Before launching the product behind this there were questions about regulatory compliance. > “Andrea Walne, Carta's head of liquidity solutions, was pushed out after she raised concerns about regulatory compliance [of CartaX].” https://www.nytimes.com/2020/08/30/business/carta-workers-inequality.html https://www.nytimes.com/2020/08/30/business/carta-workers-in...
hipadev23 3y ago
This is a massive breach of trust. We’re in the middle of a raise, we did our SAFEs with Mercury but hadn’t gotten to cap table stage yet. Guess we’ll use Pulley instead of Carta.
- paulgb 3y ago
  I went with Pulley after a Carta sales rep called me out of the blue, on a number they must have scraped (or bought from someone who scraped) from an SEC filing, ignoring the do-not-call registry.
RyeCombinator 3y ago
Took a quick look on here https://carta.com/careers/ https://carta.com/careers/ "Carta is a place where everyone can be the best version of themselves." If this is the best version of the current CEO I can't imagine what the day to day looks like.
supafastcoder 3y ago
Why does a cap table company need 2000 employees again?
- x0x0 3y ago
  Their last raise was $500m at a $7.4B valuation. Using a 10x rule of thumb, that implies they make $740m/year, or the vc believes they will grow into making that. I can't understand it either.
- sangnoir 3y ago
  As this drama prominently shows: Carts is tying it's darndest not to be just a "cap table company"
anizan 3y ago
Hard to beat pen and paper for privacy.
yinser 3y ago
“ If you use Carta to manage your cap table, they will spam all your investors.” - Paul Graham 2021 https://x.com/paulg/status/1356643841659572227?s=46&t=gIaMUOLxHiEBBS2XqapYcg https://x.com/paulg/status/1356643841659572227?s=46&t=gIaMUO...
dang 3y ago
Recent and related: Carta CEO's response to the unsolicited outreach to their customers' investors - https://news.ycombinator.com/item?id=38897363 https://news.ycombinator.com/item?id=38897363 - Jan 2024 (77 comments) Carta doing unsolicited tender offer outreach to their customers' investors - https://news.ycombinator.com/item?id=38886915 https://news.ycombinator.com/item?id=38886915 - Jan 2024 (73 comments)
Kiro 3y ago
I'm surprised that the cap table is considered sensitive information. In my country it's public information and all companies have the obligation to give you the full cap table on request.
- zht 3y ago
  Does your country have a thriving startup scene like the United States?
- dmitrygr 3y ago
  This is probably why your country does not have a thriving startup ecosystem. SV runs on naive young 'uns who believe the "you own 0.5% of the company" bullshit.
mstipetic 3y ago
I’m not sure where’s the surprise, they’ve been saying this was their plan from the beginning, from their initial fundraise

152 points by hubraumhugo 3y ago

This response by the CEO of Carta is pretty appalling, as it doubles down on an existing breach of trust. The response itself may actually do more reputational damage than the original "mistake".

23B1 3y ago
Don't forget how poorly he handled the harassment claims last year. This is now a pattern.
casperb 3y ago
I think you refer to this response? https://x.com/henrysward/status/1743794996732735679 https://x.com/henrysward/status/1743794996732735679
- jamestimmins 3y ago
  Yeah, thanks for including that
- manthanf1 3y ago
  https://nitter.net/henrysward/status/1743794996732735679 https://nitter.net/henrysward/status/1743794996732735679 For context, parent, replies without signing in:)
dang 3y ago
Discussed here: Carta CEO's response to the unsolicited outreach to their customers' investors - https://news.ycombinator.com/item?id=38897363 https://news.ycombinator.com/item?id=38897363 - Jan 2024 (77 comments)

simonw 3y ago

I liked Dare Obasanjo's take on this one: https://twitter.com/Carnage4Life/status/1743579253176930641 https://twitter.com/Carnage4Life/status/1743579253176930641 > Every startup plays fast and lose with user privacy until they have a come to Jesus moment which marks their transition into becoming a big company. > That Carta’s sales teams use the private data in your cap table to nag your investors to sell their shares should be that moment.

jamestimmins 3y ago
But is this really true? In my experience, it's been less of a "come to Jesus" moment and more a slow process of hiring experienced folks who understand the appropriate privacy/security posture for a growing company. Edit: I'm yet to experience (or see) it as a public breach of trust, especially when the company already has thousands of employees.
- cowthulhu 3y ago
  "Dragged to Jesus"
seanieb 3y ago
* they’re not just using that private information to nag you. They appear to be abusing their access to confidential information to price it for the buyers too.
whateveracct 3y ago
One of my unofficial roles as technical cofounder was to bring some ethics regarding customer data and privacy. If I could build the software in a way that (ab)using PII or otherwise private data unnecessarily was difficult, even better. Business types understand when things are too expensive to build ;) Not saying business folks never have good ethics regarding that stuff, but I find engineers are often more opinionated about it.

deleted 3y ago

[deleted]

casperb 3y ago

Two more examples in this thread: https://x.com/anothercohen/status/1743807313306140809 https://x.com/anothercohen/status/1743807313306140809

seanieb 3y ago
There’s examples going back years to when they released the third party sales product, CartaX. Funnily there were internsl signs that there were problems with this product before it launched: “Andrea Walne, Carta's head of liquidity solutions, was pushed out after she raised concerns about regulatory compliance [of CartaX].” - https://www.nytimes.com/2020/08/30/business/carta-workers-inequality.html https://www.nytimes.com/2020/08/30/business/carta-workers-in...

threeseed 3y ago

This is also being discussed here: https://news.ycombinator.com/item?id=38897363 https://news.ycombinator.com/item?id=38897363

hubraumhugo 3y ago

Are there any open-source cap table management alternatives?

milkglass 3y ago
Let's do it and call it Cartb
- deleted 3y ago
  [deleted]
hackernewds 3y ago
I would not trust the open source community with this private data. the potential for abuse is too distributed without practical access controls.
- mkl 3y ago
  The software would be open source, not the data. You'd probably run it on your own server/VPS, and just give appropriate people access.
paulgb 3y ago
You could just use a spreadsheet. The reason I pay for cap table management software is that it’s the easiest way to get a 409(a) valuation, which is something pretty much every US startup needs annually and open source couldn’t replace. (I looked at getting a 409(a) valuation separately and the best prices were more than cap table software that bundled one.)
ugh123 3y ago
spreadsheets

seanieb 3y ago

It appears as if they didn’t just mishandle the data, but also used that data to help investors price their offers based on several confidential factors.

monkeybusi 3y ago
[dead]
Simon_ORourke 3y ago
Is there anything the SEC could intervene with on that particular allegation - I mean, it's more-or-less insider trading right?
- seanieb 3y ago
  Before launching the product behind this there were questions about regulatory compliance. > “Andrea Walne, Carta's head of liquidity solutions, was pushed out after she raised concerns about regulatory compliance [of CartaX].” https://www.nytimes.com/2020/08/30/business/carta-workers-inequality.html https://www.nytimes.com/2020/08/30/business/carta-workers-in...

hipadev23 3y ago

This is a massive breach of trust. We’re in the middle of a raise, we did our SAFEs with Mercury but hadn’t gotten to cap table stage yet. Guess we’ll use Pulley instead of Carta.

paulgb 3y ago
I went with Pulley after a Carta sales rep called me out of the blue, on a number they must have scraped (or bought from someone who scraped) from an SEC filing, ignoring the do-not-call registry.

RyeCombinator 3y ago

Took a quick look on here https://carta.com/careers/ https://carta.com/careers/ "Carta is a place where everyone can be the best version of themselves." If this is the best version of the current CEO I can't imagine what the day to day looks like.

supafastcoder 3y ago

Why does a cap table company need 2000 employees again?

x0x0 3y ago
Their last raise was $500m at a $7.4B valuation. Using a 10x rule of thumb, that implies they make $740m/year, or the vc believes they will grow into making that. I can't understand it either.
sangnoir 3y ago
As this drama prominently shows: Carts is tying it's darndest not to be just a "cap table company"

anizan 3y ago

Hard to beat pen and paper for privacy.

yinser 3y ago

“ If you use Carta to manage your cap table, they will spam all your investors.” - Paul Graham 2021 https://x.com/paulg/status/1356643841659572227?s=46&t=gIaMUOLxHiEBBS2XqapYcg https://x.com/paulg/status/1356643841659572227?s=46&t=gIaMUO...

dang 3y ago

Recent and related: Carta CEO's response to the unsolicited outreach to their customers' investors - https://news.ycombinator.com/item?id=38897363 https://news.ycombinator.com/item?id=38897363 - Jan 2024 (77 comments) Carta doing unsolicited tender offer outreach to their customers' investors - https://news.ycombinator.com/item?id=38886915 https://news.ycombinator.com/item?id=38886915 - Jan 2024 (73 comments)

Kiro 3y ago

I'm surprised that the cap table is considered sensitive information. In my country it's public information and all companies have the obligation to give you the full cap table on request.

zht 3y ago
Does your country have a thriving startup scene like the United States?
dmitrygr 3y ago
This is probably why your country does not have a thriving startup ecosystem. SV runs on naive young 'uns who believe the "you own 0.5% of the company" bullshit.

mstipetic 3y ago

I’m not sure where’s the surprise, they’ve been saying this was their plan from the beginning, from their initial fundraise