Security & data handling
Selling a business means handing over tax returns, payroll, customer concentration, and the fact that you are selling at all — often before you have decided to trust anyone. This page describes what protects those materials, so you can judge it before you upload anything.
At rest
AES-256-GCM envelope encryption
Documents uploaded since envelope encryption shipped are encrypted under a per-document data key, which is itself wrapped by a master key held outside the application. Each ciphertext is cryptographically bound to the document it belongs to, so a ciphertext cannot be swapped for another document's and still decrypt. Storage media additionally sit on FileVault-encrypted volumes.
In transit
Encrypted in transit
All traffic between your browser and the deal room is encrypted, and current browsers negotiate TLS 1.3.
Access
Multi-factor by default, with step-up on sensitive files
Sign-in requires a password hashed with Argon2id at OWASP-recommended parameters, plus a second factor — an authenticator app, a passkey, or a single-use backup code. Downloading the most sensitive categories, such as tax returns or personal identification, requires a fresh second-factor challenge rather than relying on an old session. Accounts lock after three failed attempts, on an escalating delay.
Accountability
Seven-year hash-chained audit trail
Every meaningful action — sign-in, document view, document download, NDA acceptance, question submitted, access change — is written to an append-only, hash-chained log that is verified nightly. Altering a past entry invalidates every entry after it, so tampering is detectable rather than merely discouraged. Retention is seven years from the close or abandonment of the deal, matching the broker of record's obligations.
Attribution
Per-buyer marking on deal-room documents
PDF documents downloaded from a deal room carry an appended marker naming the buyer who took them and the room they came from. Being straight about its limits: it is a trailing marker, not embedded document metadata, so re-saving the file through most PDF tools removes it. Visible on-page watermarking is not implemented, non-PDF formats such as spreadsheets carry no marker at all, and the downloadable NDA is not marked. Treat it as an attribution aid, not a control that stops a determined recipient.
Where we stand on formal standards
Buyers and their counsel ask about frameworks, and the honest answer is that we have built and documented against them without yet buying an audit. We would rather say so than imply a certification we do not hold.
- SOC 2
- Controls are mapped to the Security, Availability, and Confidentiality Trust Services Criteria. An independent auditor has not been engaged and no attestation report exists yet.
- ISO/IEC 27001:2022
- A documented information-security management system with a Statement of Applicability covering Annex A controls. Aligned, not certified.
- ISO/IEC 27701:2019
- Privacy information management. Account holders can export their data, withdraw consent, raise a processing objection, or delete their account from inside the portal rather than by emailing us.
- ISO/IEC 42001:2023
- AI management. Every surface that uses a language model carries a documented system card. See how we use AI for which outputs are model-generated and which are ordinary arithmetic.
If your buyer's diligence checklist requires a completed SOC 2 report, say so early and we will tell you plainly where that leaves the timeline instead of discovering it at signing.
Reporting a problem
If you believe you have found a vulnerability, or that information has been exposed, contact us through the abuse and security contact page. We would rather hear it from you than not hear it.