Security
TrustDeck holds documents that close deals — NDA-gated, lender-reviewed, and referenced for decades. Security is not a feature tier here; the controls below apply to every account, on every plan.
The controls
Every workspace is isolated with Row-Level Security enforced inside the database itself — not just in application code. Every query is scoped to your workspace, and the application layer re-checks authorisation on every privileged operation as defence in depth. A misbehaving query cannot cross a workspace boundary.
TOTP-based MFA with single-use recovery codes is available on every account, on every tier. Sensitive areas of the application require an MFA-elevated session. External counterparties authenticate through single-use, expiring magic links — no shared passwords circulating in email threads.
Every access, download, permission change, invitation, and NDA acceptance is recorded in an append-only audit log. Updates, deletions, and truncation are blocked at the database level — not by policy, by triggers and revoked privileges. Retained for the life of your workspace plus 7 years, and exportable at any time.
Each NDA acceptance is recorded as an immutable row capturing the IP address, user agent, timestamp, signature method, and a frozen copy of the exact rendered document the counterparty saw. If the template is edited later, the evidence of what was agreed does not change.
Documents viewed inline carry the viewer's email, IP address, and a UTC timestamp on every page — stamped on the server before a single byte reaches the browser. If a draft leaks, you know exactly which copy it was.
Document content is never served from a public URL. Every view and download uses a signed URL with a five-minute lifetime, minted only after the permission gate — room membership, role, per-member toggles, revocation, and expiry — has passed.
Per-member download, print, and forward controls; time-limited access; one-click revocation with a full audit trail. External reviewers see only the rooms, folders, and Q&A threads they have been explicitly granted.
All traffic is encrypted in transit with TLS. Documents and metadata are encrypted at rest by our storage providers. Service credentials are scoped, rotated, and never embedded in client code.
Residency & ownership
Documents and metadata live in the EU (Ireland) unless you ask otherwise. Additional residency options, including single-tenant deployment, are available on the Enterprise tier by arrangement.
Export everything at any moment — every document as a ZIP with a checksum manifest from room settings, and the full audit log as CSV. Cancellation triggers a clean data export within 48 hours. We never hold your data hostage.
Account and deal-activity notifications only. No tracking pixels in your documents, no analytics resold, no marketing lists built from deal metadata.
A SOC 2 Type II audit is on the roadmap, and the platform is built to that standard today — immutable logging, least-privilege access, and documented controls. Enterprise customers can review audit and penetration-test reports under NDA. EU hosting and full data export support GDPR-aligned data handling; our Data Processing Agreement is published, with a signed copy available on request.
Found a vulnerability? Report it through the contact form and select "Security question or disclosure". We acknowledge reports within one business day, keep you informed through remediation, and credit researchers who report in good faith.
Security questionnaires, residency requirements, procurement reviews — send them through. We answer in plain language, with specifics.
