Sign InStart trial
  1. Home/
  2. Security

Security

Our Commitment to Security

  • AES-256 encryption
  • MFA
  • Full audit trail

Last updated: : 05.10.2026

Request security overviewBook a demo

Our approach to security

In M&A and fundraising, a single leaked document can cost the deal. That is why security decisions at Boundeal start at the architecture level: least privilege by default, defense in depth across every layer, and access that always begins from zero. An independent SOC 2 Type II audit is underway to verify these practices against AICPA standards.

Beyond the audit, we are preparing independent penetration testing. External researchers will probe the platform the way an attacker would, so weaknesses are found and fixed before they reach your data room.

Security Overview

note

Document Security

Only authorized users can access critical files, providing peace of mind when managing sensitive information.

fingerprint

Access & Identity

Temporary access links ensure that sensitive documents can be securely shared without risking long-term exposure.

database

Infrastructure & Data

Track all activities within the VDR, providing a transparent record of who accessed what and when.

magnifier

Monitoring & Compliance

We regularly review security measures to ensure evolving standards and regulations compliance.

Access & Identity 

Granular Permissions
layers

Control exactly what each participant can view, download, edit, or print, with 2FA/MFA, SSO, session timeouts, IP and domain restrictions, and email verification.

Account-Level Roles
user

Assign clear account-wide roles such as Owner, Manager, or Member to keep responsibilities and access under control.

Project-Level & Custom Roles
unlim-users

Define flexible, project-specific permissions and tailor participant access to the needs of each deal.

Permission Inheritance
folder

Apply permissions automatically across folder structures, with the flexibility to create exceptions where needed.

Verified Participant Access
fingerprint

Invite participants only through verified email identities to ensure that access is granted to the right people.

Secure Document Links
link-simple

Share documents through time-limited, signed links with controlled access to uploads, previews, and downloads.

NDA Access Gate
pen

Require participants to accept a confidentiality agreement before entering, with every acceptance recorded in the audit trail.

API & Integration Security
keys

Secure integrations with dedicated service credentials, IP allowlisting, rate limits, and fully auditable API activity.

A sell-side process brings bidders, advisors, legal, and tax teams into one data room, and each needs a different view. Permission Groups separate them, Roles & Permissions define what every participant can do, and Granular Permissions control access down to a single folder or document.

Five access levels, from None to Manage, give each participant exactly what their role requires: view only, protected PDF, original file, or full management.

Document Protection

Control over a document usually ends the moment someone downloads it. Boundeal keeps working after that point: Secure Preview lets participants review files inside the platform, access levels control whether the original file can be downloaded at all, and Watermarking marks every downloaded copy.

If a page leaks, the watermark shows who received that copy, and the Audit Trails show when.

Dynamic Watermarking
note

Automatically apply dynamic watermarks with participant name, email, IP address, timestamp, and project name to protect sensitive documents.

Permission-Controlled Preview / IRM Viewer
screen-share

View documents securely in the browser without downloading the original file.

Download Control
lock

Access levels decide whether a participant views a file in Secure Preview only, receives a protected PDF, or downloads the original.

Infrastructure & Data Protection

Deal data needs infrastructure you do not have to think about. Boundeal runs on hardened AWS in the US West (Oregon) region, with an EU region in development. Files are encrypted with AES-256 at rest and TLS 1.2+ in transit, keys live in AWS KMS, and backups are stored encrypted.

DDoS protection and WAF shield the network, production access is restricted and audited, and enterprise agreements add a 99.9% uptime SLA with cross-region disaster recovery.

Encryption & Keys
  • Encryption at rest — AES-256 encryption via AWS KMS
  • Encryption in transit — TLS 1.2+
  • Key management — KMS with least-privilege access and key rotation
  • Encrypted backups — Securely encrypted backup storage
Resilience & Network
  • Data residency — Production hosted in AWS US West (Oregon); EU region in development
  • Network protection — DDoS protection, WAF, and Infrastructure as Code
  • Controlled production access — Protected network architecture and restricted access
  • Enterprise uptime SLA — 99.9% availability
  • Cross-region disaster recovery
Enterprise-Only Data Controls
  • Customer-managed KMS keys (BYOK) — Full control over encryption keys
  • Customer-controlled S3 storage — Store data in your own AWS environment
  • Private cloud connectivity — Secure connectivity to private cloud infrastructure

Monitoring, Logging & Audit Trail

When a bidder disputes what they saw, or a regulator asks who accessed the financials, memory is not evidence. Audit Trails record every action: who opened which document, when, from where and what they did, filterable by participant, role or document and exportable to CSV or PDF.

Reports & Insights turn the same records into a live picture of the process, and access to audit data itself requires a dedicated permission, so sensitive activity stays protected.

Complete Audit Trail
nodes

Track who did what and when, with continuous threat monitoring and alerts for suspicious activity.

Viewer Context
annotation

Capture viewer context including IP address, browser, device type, and approximate geographic location.

Advanced Filtering
toggle

Filter audit activity by date, participant, role, permission group, document, or action type.

Exportable Reports
note2

Export audit reports in CSV or PDF format for analysis, sharing, and compliance purposes.

Permission Change History
clock

Maintain a complete history of permission changes to track how access evolves over time.

Controlled Audit Access
fingerprint

Restrict audit log access to authorized users with a dedicated permission, keeping sensitive activity data protected.

Defense-in-Depth Logging
note

Maintain separate logs across admin activity, identity providers, document storage access, and infrastructure audit events.

Compliance & Certification Roadmap

Buyers and investors ask about certifications during every due diligence, so we publish our status as it stands. Secure SDLC is implemented across development, the SOC 2 Type II audit is in progress with completion targeted for [date — TO CONFIRM], ISO 27001 certification is planned, and GDPR alignment is an ongoing practice reflected in our Privacy Policy.

Implemented
Secure SDLC

Security is built into every stage of our development lifecycle.

Audit in Progress
SOC 2 Type II

Audit currently in progress, with completion targeted for [date].

Planned
ISO 27001

ISO 27001 certification planned for [date].

Ongoing
GDPR Alignment

Ongoing GDPR alignment with our Privacy Policy and data protection practices.

Secure Development & Operations

tag-simple
Secure SDLC
repeat
Regular Patching
nodes
Vulnerability Management
user
Least-Privilege Access
security-shield
Antivirus & Threat Monitoring

Every Boundeal release goes through secure SDLC checks before it ships: dependencies are patched on a regular cycle, and vulnerabilities are tracked and prioritized through continuous management.

Security by Plan

Boundeal delivers the most value where confidential documents change hands under pressure: sell-side M&A and cross-border deals, fundraising from seed to Series A, restructuring cases, and the daily work of legal and due diligence teams.

suitcase
M&A Due Diligence
transaction
Fundraising
note
Restructuring
e-mail
Law Firms

Security FAQs

Production data is hosted on AWS in the US West (Oregon) region; an EU region is in development.
Yes. Request our security overview — we answer questionnaires and share available documentation under NDA. Independent penetration testing is currently in preparation.
If you cancel your subscription, we retain your data for a limited period in case you re-activate your account. After this period, all your data is permanently deleted.
Yes. Participants must accept your confidentiality terms before opening any content, and every acceptance is recorded in the Audit Trails.
Yes — admins can upload a custom confidentiality agreement at the project level.
[SSO status — TO CONFIRM] SAML SSO is available on the Enterprise plan, alongside 2FA/MFA, session timeouts, and IP and domain restrictions.
AES-256 at rest and TLS 1.2+ in transit, with keys managed in AWS KMS under least-privilege access.
Only participants you explicitly invite through verified email identities, within the permissions you set. Access starts from zero and every view is logged.
Contact us at [security@boundeal.com — TO CONFIRM]; we review every report.

Still have a question?

Contact Us

Join Boundeal

An AI-powered virtual data room built for M&A and fundraising: secure by architecture, transparent in every action, ready for your next deal.

Start Free TrialTalk to Our Team