Carta is investigating an “internal breach of protocol” that affected Linear and two other companies, where an employee contacted someone “on the cap table”
Anne VanderMey / Bloomberg :
Context & Ripple Effects
Carta's role managing Linear's cap table put it in a position of unusual access to sensitive ownership information. The incident follows Linear's allegation that Carta attempted to sell its shares without consent, described in Linear's account of the attempted share sale.
The issue matters beyond the three affected companies because Carta also operated a service matching private-company stock buyers and sellers. The company subsequently said it would shut down that liquidity business amid concerns over how data could be used.
First-order effects
- Carta must investigate the employee's contact with a person on a customer's cap table and reassure the affected companies that access to ownership data and outreach are properly controlled.
- Linear and the two other affected customers face an immediate trust and confidentiality question around their cap-table information and shareholder relationships.
Second-order effects
- Closing the liquidity service removes a business where access to cap-table data could be perceived as conflicting with customers' interests, while limiting Carta's role in private-share transactions.
- Other cap-table-management customers may seek clearer internal-access controls and separation between recordkeeping and any transaction-related activity; providers in the category will face the same scrutiny.
Third-order effects
- If customers treat cap-table data as too sensitive to sit alongside transaction services, private-market infrastructure may move toward stricter functional separation and auditable permissions.
- The episode underscores that governance and culture concerns can become product-market risks for software that holds confidential company and investor records, especially as Carta faces allegations from its former CTO about leadership and board oversight.
The trend: Private-market software providers are being pushed to prove that privileged customer data is insulated from adjacent monetization and transaction activities.