Dealspace has completed a comprehensive SOC 2 Type II self-assessment. We are preparing for formal audit certification in Q4 2026.
Note: This is a self-assessment document. Formal SOC 2 Type II audit is planned for Q4 2026.
SOC 2 (System and Organization Controls 2) is an auditing framework developed by the AICPA that evaluates how organizations manage customer data based on five Trust Services Criteria.
For M&A platforms handling confidential deal data, SOC 2 compliance demonstrates a commitment to security, availability, and data protection that investment banks and advisors require.
Assessment Date: February 28, 2026
Our SOC 2 assessment covers all aspects of the Dealspace platform and infrastructure.
SOC 2 evaluates organizations against five Trust Services Criteria. Dealspace implements controls for all five.
Protection against unauthorized access, both physical and logical.
Systems are available for operation and use as committed.
Information designated as confidential is protected as committed.
System processing is complete, valid, accurate, timely, and authorized.
Personal information is collected, used, retained, and disclosed in conformity with commitments.
FIPS 140-3 validated AES-256-GCM with per-project keys derived via HKDF-SHA256
JWT tokens with 1-hour expiry, MFA required for IB users, session management
Role hierarchy (IB → Seller → Buyer → Observer), invitation-only access
Swiss data center, UFW firewall, SSH key-only, automatic security updates
All access logged with actor, timestamp, IP. 7-year retention for compliance
Daily encrypted backups, 4-hour RTO, 24-hour RPO, tested recovery procedures
Our SOC 2 program is supported by comprehensive policy documentation.
Complete SOC 2 Type II self-assessment with control mappings
Security requirements for systems, data, and operations
Procedures for detecting and responding to security incidents
Recovery procedures following disasters affecting systems
Data retention periods and deletion procedures
Identified risks and mitigation controls
Comprehensive self-assessment against all five Trust Services Criteria completed. Policy documentation created.
Address recommended action items including backup restore testing and external penetration test.
Engage third-party auditor for formal SOC 2 Type II certification.
Contact our security team for detailed documentation or to discuss your compliance requirements.