How should we protect confidential information before funding round?

Why not split the information into 2 categories, general plus detail where you make the fine data available for the due-diligence phase once a memorandum has been signed. The summaries would need to be carefully screened for trade secrets, potential patents or commercial-in-confidence commercial dealings. But your best bet is to ask around who are reputable funders. The VC industry is not that large that a bad actor can get away with stealing ideas for in-house dev-teams on a regular basis. Note that you have to accept that with so many me-too ideas, just because they pass on your startup doesn't mean they can't pick another team in closely related sector. It all comes down to pattern matching when punting on early stage ideas. Everyone in the world has access to a similar tech base, the market data (at least in the developed OECD) is public so the differentiating factor is the ability of the founders to execute as demonstrated by traction and degree of fit/comfort with the investment portfolio. Like any race/competition, there are simply some who just perform better.

Yours is a very broad question, and you are probably looking at 2-3 categories of information which may be protected in different ways.

To the extent you have developed any new and useful technology (e.g., your prototype), evaluating its patentability and, in light of a positive finding, filing at least a provisional utility patent application to cover that technology may be a good idea. Filing state and federal trademark applications for word marks or logos with which you are offering your online service is also a no-brainer. The "look and feel" of your website or app may be protected under copyright.

I suspect most of the information about which you are concerned, however, is not protectable under patent, trademark, or copyright. Customer lists, financial data, and other business artifacts may be protectable under trade secret law which will vary state-to-state, but generally exists to protect against the misappropriation of information which is subject to substantial security efforts and is valuable by virtue of it being not-generally-known in the marketplace. Raw customer data that is merely public information (e.g., business name, address, points of contact), however, is often not inherently protectable.

Having an appropriately drafted non-disclosure agreement executed with a third-party potential investor is a way to contractually restrict its activities after you disclose information to it, but even NDAs have jurisdictionally-varying limits on the protective scopes.

In short: (i) identify and secure the IP assets you have; and (ii) for matter which you cannot protect under federal (patents, copyrights, and trademarks) or state (trade secrets) statutory schemes, have a contract in place which at least minimizes the risk that the potential investor takes unauthorized advantage of your disclosure.

These considerations are to be made regardless of whether you are just getting started or seeking investment. Contact an IP attorney to review the details of your enterprise and obtain actionable advice.