Security
Security and governance
How Dealsight protects confidential deal materials. For legal terms, see our Privacy Policy and Cookie Policy.
Platform overview
Dealsight is a cloud-hosted M&A diligence platform. Each customer organization is logically isolated. Deal documents, reports, and audit records are scoped to your organization and, where enabled, to individual projects and data rooms.
Encryption
All data is encrypted in transit using TLS. Customer documents and reports stored in object storage use AES-256 server-side encryption via cloud bucket defaults. Database and cache infrastructure use provider-managed encryption at rest.
Tenant isolation & access control
Every API request is authenticated and scoped to an organization. Project-level roles (viewer, contributor, admin, owner) control who can view, upload, generate reports, and manage access. Restricted data rooms fail closed — only explicit members and approved access grants can reach documents.
Virtual Data Room controls
Restricted data rooms support proxied document delivery (no direct storage URLs), PDF watermarking on view and download, guest invites with expiry and folder scope, view-only grants, optional IP allowlists, optional enterprise SSO-only access for org users, and append-only access activity logs.
AI & data handling
Customer document content is sent to AI and parsing providers solely to deliver the Service — for analysis, embeddings, search, and report generation. Customer content is not used to train Dealsight-owned models. Analytics cookies and tools load only after explicit consent.
Infrastructure
Production runs on AWS (United States): ECS Fargate for API and background workers, Amazon RDS PostgreSQL, Amazon S3 for documents and reports, and Amazon ElastiCache Redis. The web application is hosted on Vercel.
Compliance status
SOC 2 Type I certification is in progress. GDPR and CCPA programs are on our roadmap. We maintain a published subprocessor list and can provide additional security documentation on request.
Security FAQ
- Where is customer data stored?
- Primary production data is stored in AWS US regions. See our subprocessor list for third-party locations.
- Is customer data used to train AI models?
- No. Document content is processed by AI providers to deliver analysis and is not used to train Dealsight-owned models.
- Do you sell personal information?
- No. See our Privacy Policy for California and other privacy rights.
- How do I request a security questionnaire or DPA?
- Email info@dealsightai.net with your requirements. We respond to enterprise security reviews on a best-effort basis.
Last updated: July 17, 2026