Security Overview

How the DealRoom platform, including our API, AI features, and MCP connector, controls access, limits content sharing, and protects data in transit and at rest. This document complements our SOC 2 Type II report and Data Processing Agreement.

Platform security foundations

DealRoom is a cloud-based M&A deal-management platform hosted on Amazon Web Services (AWS). The API, AI features, and MCP connector are part of the platform and are covered by the controls below.

  • Hosting & residency. Hosted on AWS in the United States by default. Data residency in other regions and cloud providers is available on request. Physical data-center security is managed by the cloud provider under the shared responsibility model.
  •  Encryption. AES-256 at rest and TLS 1.2+ in transit. Encryption keys are managed by our cloud provider's key-management service, backed by FIPS 140-2 validated HSMs.
  •  Tenant isolation. Customer data is logically separated at the database level using unique identifiers and enforced at the API layer.
  • I Identity & access. Role-based access control with MFA required for internal and administrative access to sensitive systems. Customers can enforce SSO (SAML 2.0) and MFA for their own organization. DealRoom personnel have no standing access to customer data. Any access must be explicitly granted, is authenticated and encrypted, and is fully logged. Access rights are reviewed quarterly.
  •  Personnel security. Background screening, confidentiality agreements, and security awareness training at hire and at least annually.
  •  Secure development. Documented SDLC with peer code review, separation of environments, and formal change management. Production customer data is not used in non-production environments.
  •  Vulnerability management. Regular vulnerability scanning with remediation under defined SLAs, and independent penetration testing at least annually and after significant changes.
  •  Logging & monitoring. Platform activity logs and customer-visible audit trails record access to and changes in customer content. Infrastructure and security events are continuously monitored, with alerts for investigation.
  •  Resilience. Multi-AZ architecture with encrypted backups taken at least daily. Business continuity and disaster recovery plans are maintained and, under our policy, must be tested at least annually.
  • Assurance. SOC 2 Type II report covering Security, based on an independent audit. ISO 27001 certification is in progress.
‍

DealRoom AI features

Our AI features assist with M&A and deal-workflow tasks such as document summarization, extraction, classification, research, and drafting.

  •  Optional, with human review. AI outputs are suggestions for users to review, not autonomous decisions. AI features are optional and can be disabled at the organization level. They are not used to make decisions about individuals.
  •  Scoped to your data. AI features operate only on content within your own instance, subject to the same permission and tenant-isolation controls as the rest of the platform.
  •  Data in transit and at rest. When a user invokes an AI feature, the relevant content is sent to a third-party AI provider over an encrypted connection (TLS 1.2+) for inference only. The output returns to DealRoom for the user to review. Content at rest remains AES-256 encrypted in our cloud environment. AI provider details are available on request.
  •  Model training. Content processed by AI features is not used to train or fine-tune foundation models. Model providers do not train on it. Separately, as described in our Privacy Policy, we may use anonymized data to train our own models. You can opt out at any time.
  • Governance. AI features are covered by our standard platform security, logging, change-management, and risk-management processes. We rely on the model providers' published safety and responsible-AI practices, combined with human review of outputs.

DealRoom API

Customers can access DealRoom programmatically through our API (available on request). It runs on the same platform and enforces the same controls as the application.

  • Access control. Every request is encrypted with TLS 1.2+, authenticated, and authorized against the same role- and permission-based model as the application. A caller can only reach data its identity is permitted to see. Tenant isolation applies equally to API access.
  • Rate limiting & logging. Requests are rate-limited at the API layer, and API access is captured by the same platform activity logs and audit trails as application access.

DealRoom MCP connector

DealRoom provides a Model Context Protocol (MCP) server that lets MCP-compatible AI clients, such as Claude or Microsoft Copilot, work with DealRoom content on a user's behalf. It is an authenticated layer over our platform API. The server is not a model and does not make decisions. The connector is currently in limited beta, and its capabilities are evolving.

  • Individual authentication. Each user authenticates via OAuth 2.0 with their own DealRoom identity. There are no shared or service accounts. Organization SSO (SAML 2.0) and MFA apply at sign-in. External and guest users are not supported.
  •  Live, server-side authorization. Every request is checked against that user's existing DealRoom permissions, from the organization down to the individual document. Permissions are used directly, with no remapping or separate permission store, so the connector cannot return anything the user could not already open in DealRoom. Permission changes, user deactivation, and revoked authorization take effect immediately.
  •  Bounded data exposure. The connector exposes a defined set of objects (deals, rooms, folders, documents, tasks, findings, and related metadata), always scoped to the requesting user. Document content is returned only as extracted text, and only where the user holds "view original" permission. Content remains in our cloud environment and is retrieved only when requested. There is no separate connector-side customer-content store or external index.
  •  Limited operations. The connector supports reading and limited create/update operations. It cannot delete, share, or change permissions or membership, so it cannot grant or extend access. Authorization is enforced server-side regardless of how a request was generated.
  •  No automatic sharing. Retrieved content reaches another person only if the user shares it through tools in their own environment, subject to that environment's sharing and data-protection controls. Administrators can disable the connector for the organization or limit which users can use it.
  •  Logging & audit. Every request is logged and attributed to the individual user and organization, including failed authentication and authorization attempts. Write operations appear in the DealRoom audit trail available to your administrators. User prompts and AI-generated responses stay within the AI client environment. DealRoom receives only the connector tool calls required to perform the requested operations.
  • Administration & token security. The integration is enabled per organization and is off by default. Disabling it immediately revokes all issued tokens, and individual users can revoke their own authorization at any time. Access tokens are short-lived and encrypted at rest, and all traffic is encrypted with TLS 1.2+.

Encryption and data handling summary

Documentation & contacts

This overview summarizes current controls; specific contractual terms are governed by your agreement with DealRoom. To complete a formal security questionnaire or arrange a walkthrough, please contact your Account Executive or Account Manager.