Sign InStart trial
  1. Home/
  2. Security

Security

How We Protect Your Deals

  • AES-256 data encryption
  • MFA
  • Complete activity log

Last updated: : 05.10.2026

Get the security overviewSchedule a demo

How we think about protection

One exposed file in an M&A process or a funding round is enough to sink the transaction. For this reason, Boundeal makes security choices at the level of its architecture: minimal privileges as the default, layered defenses throughout the stack, and every grant of access starting at zero. An independent SOC 2 Type II audit is underway to check these controls against AICPA criteria.

Alongside the audit, independent penetration testing is being prepared. Outside researchers will attack the platform as a real intruder would, so any gaps are discovered and closed before they can affect your data room.

Security at a Glance

document icon

Protected Documents

Critical files open only to authorized users, so handling confidential information stays calm and controlled.

fingerprint icon

Identity & Access

Expiring access links let you share confidential documents safely, without leaving them exposed for long.

database icon

Data & Infrastructure

Every action inside the VDR is logged, giving you a clear record of which person opened which file and at what time.

magnifying glass icon

Compliance & Monitoring

Our security controls are reviewed on a regular basis to keep pace with changing standards and regulatory requirements.

Identity & Access 

Fine-Grained Permissions
layers icon

Decide precisely whether each participant may view, download, edit or print, backed by 2FA/MFA, SSO, session timeouts, IP and domain restrictions, and email verification.

Roles Across the Account
participants icon

Give people defined roles for the whole account, such as Owner, Manager or Member, so duties and access stay well managed.

Custom and Per-Project Roles
Unlimited users icon

Set up adaptable permissions for each project and shape what participants can reach to match every deal.

Inherited Permissions
Folder icon

Permissions flow down through folder trees on their own, and you can still carve out exceptions wherever required.

Access for Verified Participants
fingerprint icon

Participants are invited solely via confirmed email identities, so only the intended people get in.

Protected Document Links
Link icon

Send documents via signed links that expire after a set time, with managed access to uploading, previewing and downloading.

NDA Access Gate
pen icon

Participants must agree to confidentiality terms before they enter, and the audit trail stores each acceptance.

Securing APIs and Integrations
keys icon

Integrations are protected by dedicated service credentials, IP allowlisting and rate limits, and every API call can be audited.

In a sell-side deal, bidders, advisors, lawyers and tax specialists all work in the same data room, yet each group should see something different. Permission Groups keep them apart, Roles & Permissions set what each participant is allowed to do, and Granular Permissions govern access to an individual folder or even one document.

With five access levels ranging from None to Manage, every participant gets precisely what the role calls for: view only, a protected PDF, the original file or full management rights.

Protecting Your Documents

In most cases, you lose control of a file once it has been downloaded. Boundeal continues to protect it beyond that moment: Secure Preview keeps review inside the platform, access levels determine whether the original can be downloaded in the first place, and Watermarking stamps each copy that leaves the room.

Should a page get out, its watermark identifies the recipient of that copy, and the Audit Trails reveal the time.

Dynamic Watermarks
document icon

Dynamic watermarks showing the participant's name, email, IP address, timestamp and project name are added automatically to safeguard confidential files.

Permission-Based Preview / IRM Viewer
Screen sharing icon

Open and read files safely in the browser while the original never leaves the platform.

Controlling Downloads
padlock icon

The access level determines whether a participant can only open a file in Secure Preview, gets a protected PDF, or may download the original.

Data & Infrastructure Safeguards

Your deal data should sit on infrastructure that never needs your attention. Boundeal operates on hardened AWS in the US West (Oregon) region, and an EU region is in development. Files are protected with AES-256 encryption at rest and TLS 1.2+ in transit, encryption keys are held in AWS KMS, and backups are kept in encrypted form.

The network is guarded by DDoS protection and a WAF, access to production is limited and audited, and enterprise contracts include a 99.9% uptime SLA plus cross-region disaster recovery.

Keys & Encryption
  • Data at rest — AES-256 encryption through AWS KMS
  • Data in transit — TLS 1.2+
  • Managing keys — KMS with key rotation and least-privilege access
  • Backup encryption — Backups kept in encrypted storage
Network & Resilience
  • Where data lives — Production runs in AWS US West (Oregon); an EU region is in development
  • Protecting the network — Infrastructure as Code, DDoS protection and WAF
  • Restricted production access — Limited access within a protected network architecture
  • Uptime SLA for Enterprise — 99.9% availability
  • Disaster recovery across regions
Data Controls for Enterprise Only
  • Customer-managed KMS keys (BYOK) — Complete ownership of your encryption keys
  • Customer-controlled S3 storage — Keep data inside your own AWS environment
  • Private cloud connectivity — Protected links to your private cloud infrastructure

Audit Trail, Logging & Monitoring

If a bidder questions what was shown to them, or a regulator wants to know who opened the financial statements, recollection proves nothing. Audit Trails capture each action: which document a person opened, at what time, from which location and what was done with it. Records can be filtered by participant, role or document and exported as CSV or PDF.

Reports & Insights use those same records to show the process as it unfolds, and viewing the audit data requires its own permission, which keeps sensitive activity shielded.

Full Audit Trail
network nodes icon

See which person took which action and at what time, backed by ongoing threat monitoring and alerts on suspicious behavior.

Context of Each View
annotation icon

Record each viewer's IP address, browser, device type and approximate geographic location.

Detailed Filters
toggle switch icon

Narrow audit activity by action type, document, permission group, role, participant or date.

Reports for Export
Document icon

Download audit reports as CSV or PDF to analyze, share or meet compliance needs.

History of Permission Changes
Clock icon

Keep a full record of every permission change to follow how access shifts over the life of a project.

Restricted Audit Access
fingerprint icon

Only authorized users holding a dedicated permission can open audit logs, so sensitive activity data stays protected.

Layered Logging
document icon

Separate logs are kept for admin activity, identity providers, document storage access and infrastructure audit events.

Certifications & Compliance Plan

Certifications come up in every due diligence with buyers and investors, so we state our position openly. Secure SDLC is in place across development, the SOC 2 Type II audit is in progress with completion targeted for [date — TO CONFIRM], ISO 27001 certification is planned, and GDPR alignment is a continuous practice described in our Privacy Policy.

In Place
Secure SDLC

Security is part of each phase of how we build software.

Audit Underway
SOC 2 Type II

The audit is in progress, and completion is targeted for [date].

Planned
ISO 27001

Certification under ISO 27001 is planned for [date].

Ongoing
Aligning with GDPR

Continuous GDPR alignment through our data protection practices and Privacy Policy.

Secure Operations & Development

Tag icon
Secure SDLC
Update cycle icon
Routine Patching
network nodes icon
Managing Vulnerabilities
participants icon
Minimal-Privilege Access
Security shield icon
Threat Monitoring & Antivirus

Before any Boundeal release goes live, it passes secure SDLC checks. Dependencies receive patches on a set schedule, and vulnerabilities are logged and ranked as part of ongoing management.

Security Across Plans

Boundeal is most useful wherever confidential files are exchanged under time pressure: sell-side M&A and cross-border transactions, funding rounds from seed to Series A, restructuring matters, and everyday work by legal and due diligence teams.

briefcase icon
Due Diligence for M&A
transaction icon
Fundraising
document icon
Restructuring
email icon
Legal Firms

Questions About Security

Production data lives on AWS in the US West (Oregon) region; an EU region is in development.
Yes. Ask for our security overview: we fill in questionnaires and provide the documentation we have under NDA. Independent penetration testing is being prepared at the moment.
After a subscription is cancelled, your data is kept for a limited period in case you decide to reactivate the account. Once that period ends, all of your data is permanently deleted.
Yes. Before any content opens, participants have to accept your confidentiality terms, and the Audit Trails log each acceptance.
Yes — a custom confidentiality agreement can be uploaded by admins for each project.
[SSO status — TO CONFIRM] On the Enterprise plan, SAML SSO is offered together with 2FA/MFA, session timeouts, and IP and domain restrictions.
AES-256 for data at rest and TLS 1.2+ for data in transit, while keys are handled in AWS KMS with least-privilege access.
Only the participants you invite yourself via verified email identities, and only within the permissions you assign. Access begins at zero, and each view is logged.
Write to [security@boundeal.com — TO CONFIRM]; each report is reviewed.

Have more questions?

Contact Us

Get Started with Boundeal

A virtual data room with AI built in, designed for M&A and fundraising: secure in its architecture, transparent in each action and prepared for the deal you close next.

Start Free TrialSpeak with Our Team