New: figures written in the text are now cross-checked against the statements automatically.How it works
Trust

Security

Where your documents are processed and stored, who can reach them, and what is recorded.

Last updated October 16, 2026

In short. Documents are read in your browser by fixed rules. No AI model reads them, and they are never sent to an AI provider. Results and originals are stored in your firm’s private workspace, which the database keeps separate from every other firm. Admins control access, can require two-factor sign-in, see an activity log, and can export or permanently delete the workspace.

1. How documents are processed

  • In your browser. When you upload a file, it is read on your own computer by the DealBasis code running in the page. PDFs, spreadsheets, Word files and CSVs are turned into text and figures there, before anything is saved.
  • By fixed rules, not AI. Every figure and finding comes from tested rules. The same documents always give the same answer, and every figure links to the page, line, cell or row it came from. No AI model reads your documents, and they are not used to train one.
  • Scanned pages and pictures of tables. A PDF page with no text layer, or a table pasted into a PDF as a picture, is read with open-source text recognition (Tesseract), also in your browser. Figures read this way are marked as coming from a scan and listed for review, so they can be checked against the page.
  • Code libraries. The page loads open-source libraries from public content networks: pdf.js, SheetJS, ExcelJS, Mammoth, JSZip and Tesseract to read files, and docx, jsPDF and PptxGenJS to build the reports you download. They run in your browser; your documents are not sent to those networks.

2. Where data is stored

  • Supabase holds the database, file storage and sign-in. Vercel serves the website and platform.
  • What is stored: each deal’s extracted figures and results, your team’s decisions and notes, and the original files so a citation can open the page itself.
  • Files sit in a private storage bucket, in a folder that belongs to your workspace. Only your workspace’s members can reach them. When a file is opened, it is fetched with your own sign-in or through a link that expires after five minutes. There are no public links.

3. Encryption

  • Every connection uses HTTPS. The site sends Strict-Transport-Security for two years, including subdomains, so browsers refuse unencrypted connections.
  • Supabase encrypts the database and stored files on disk.

4. Each firm’s data is separate

  • Every deal, file, invite, member and log entry belongs to one workspace. Row-level security in the database enforces this on every table and on file storage, so the separation doesn’t depend on the app.
  • Three roles: Admin (access and settings), Member (works on deals) and Viewer (read only). Viewers can’t change or upload anything, which the database also enforces.
  • People join a firm by an admin’s invite or with a confirmed email at the firm’s domain. Personal email domains can’t be used as a firm domain, and each domain belongs to one workspace. An admin can remove someone immediately.

5. Signing in

  • Passwords are stored only as a secure hash by our sign-in provider.
  • Anyone can turn on two-factor sign-in with an authenticator app. An admin can require it for the whole workspace; once required, a session without two-factor gets no data at all, enforced by the database.
  • Each workspace sets how soon inactive sessions are signed out, from 15 minutes to 8 hours (30 minutes unless changed). It applies across all open tabs.

6. Activity log

The database records sign-ins and sign-outs, deal changes, uploads, deletions, file openings, invites, access and settings changes, exports and two-factor changes, with who and when. Entries can’t be edited or deleted from the app, only admins can read them, and admins can filter the log and download it as CSV. The log contains no document contents and is kept after a workspace is deleted, so a firm can still show who accessed what.

7. Export and deletion

  • An admin can download the whole workspace (deals, settings, members, the activity log and every file) as one ZIP file.
  • An admin can permanently delete the workspace, which removes its files, deals, invites and members. After an account ends, data is deleted from active systems within 30 days, and backups expire on their normal schedule.

8. Browser protections

Pages can’t be framed by other sites (to prevent clickjacking), browsers are told not to guess file types, referrers are limited, and camera, microphone and location access are turned off.

9. What we don’t claim

  • DealBasis has not completed a SOC 2 audit. The platform is built with SOC 2 controls in mind, and we’ll say so plainly when an independent audit is complete.
  • Whoever administers the hosting accounts could technically read stored data, as with almost every hosted service.
  • The activity log records what happens through DealBasis; changes made directly in the hosting provider’s console are recorded in that provider’s own logs.

10. Reporting a security concern

Inside the platform, use Help, then Get help; requests are stored privately. Otherwise, use our contact form. We’ll reply as quickly as we can.