Security That Compliance Teams Trust
M&A data is sensitive. People go to prison for leaking it. We built Dealspace with security as the foundation, not an afterthought.
SOC 2
Self-Assessed · Type II in progress
FIPS 140-3
Validated encryption
GDPR
Compliant processing
ISO 27001
Certified ISMS
FIPS 140-3 Validated Cryptography
We use the same encryption standards required by US federal agencies. Your deal data is encrypted with AES-256-GCM using FIPS 140-3 validated cryptographic modules.
Per-Deal Encryption Keys
Each deal has its own encryption key derived from a master key. One deal's compromise does not affect others.
Encryption at Rest
All data encrypted before it touches disk. File content, metadata, comments — everything.
Encryption in Transit
TLS 1.3 for all connections. Certificate pinning for mobile apps. No data travels unencrypted.
Dynamic Watermarking
Every document is watermarked with the viewer's identity at serve time. If a document leaks, you know exactly who leaked it.
-
Generated per-request
Watermark includes user email, organization, timestamp, and deal ID.
-
All file types
PDF, Word, Excel, images, video. Protection adapts to the format.
-
Configurable per project
Control watermark content, position, and visibility.
Defense in Depth
Multiple layers of protection. Every access decision goes through the same choke point. No exceptions.
Single Sign-On
SAML 2.0 and OIDC support. Integrate with your existing identity provider. Enforce your organization's auth policies.
Multi-Factor Auth
TOTP, hardware keys (FIDO2), SMS backup. MFA required for all access, no exceptions.
Role-Based Access
Workstream-level permissions. IB, Seller, Buyer roles with configurable scopes. Least privilege by default.
Session Management
Short-lived tokens. Single active session per user. Immediate revocation on access changes.
IP Allowlisting
Restrict access by IP range. Corporate network only, or specific buyer locations.
Download Controls
Disable downloads entirely, or allow view-only access. Configurable per document or project-wide.
Complete Accountability
Every action is logged. Access grants, file views, downloads, status changes — all recorded with actor, timestamp, and IP address.
Enterprise-Grade Infrastructure
Dedicated infrastructure, redundant storage, continuous monitoring. Your deal data deserves nothing less.
Questions About Security?
Talk to our security team. We are happy to answer technical questions and provide documentation.