Security
How Dealroom protects deals and the people who negotiate them. Each statement on this page describes what the code does today.
Hosting and encryption
Our cloud runs on Vercel, in the United States, with a managed PostgreSQL database from Neon.
HTTPS everywhere
Every connection uses HTTPS (TLS), and browsers are told to use HTTPS only (HSTS).
Stored data
Our hosting and database providers encrypt stored data with AES-256. Dealroom adds no field-level encryption of its own.
No passwords
Dealroom does not use or store passwords.
No Google tokens kept
When you sign in with Google, the tokens Google returns are not stored.
Sign-in
On our cloud you sign in with a Google account or with a single-use link sent by email.
- The session is kept in an HTTP-only cookie (SameSite=Lax), sent only over HTTPS on our cloud.
- Sign-in requests and sign-in emails are rate-limited.
- On our cloud, one sign-in works across the TODO.LAW apps.
- The passwordless sign-in of the self-host kit, meant for a private network, is refused on our cloud.
Who can see a deal
Apart from the service's administrators and a lawyer assigned to review the deal, only the parties to a deal can see it. Each request for a deal checks, on the server, that you are one of its parties or assigned to it.
Invitations
The other party joins through an invitation sent by email. It can be used once, expires after 14 days, and can be accepted only by someone signed in with the address it was sent to.
Administration
The administration and supervision portals have their own sign-in, separate from the product's, and need a second factor: a code from an authenticator app, checked on the server, with a limit on attempts. A verified second factor lasts four hours and is tied to that sign-in.
Audit log and documents
Audit log
Deal, negotiation and signing actions are written to an audit log.
Contract documents
Contract documents are generated when a party asks for them and are not stored as files.
AI
AI features are off by default. Only the service's operator can switch them on, and the switch applies to the whole service. While they are off, nothing is sent to an AI provider.
Payments
Payments are taken on Stripe's own checkout pages, so Dealroom never sees card numbers. Every payment notification from Stripe is checked against its signature and processed once.
Browser protections
No framing
Other sites cannot show Dealroom's pages inside a frame.
Content Security Policy
Scripts load only from Dealroom and the two services its pages use: Google sign-in and the analytics service.
Headers
Content-type sniffing is blocked, the referrer sent to other sites is limited, and the camera, microphone and location are switched off.
Analytics
The pages use an analytics service that sets no cookies to count visits.
Agent API
API keys are stored only as a hash and are shown once, when they are created. Notifications from the dispute service are checked against their signature.
On your own hardware
The self-host kit runs the same code. It includes a script that makes encrypted database backups; you set the schedule and keep the copies. Its sign-in has no password and is meant for a private network only.
Reporting a problem
If you find a security problem, write to info@rindogatan.com with SECURITY in the subject.