Initializing workspace...
Your deal data is some of the most sensitive information your fund holds. We treat it that way — from infrastructure to access control to compliance.
Security is not a feature — it's the foundation every other feature is built on.
Compliance status
Encryption
The platform is served only over HTTPS. The database is encrypted at rest. Stored credentials — OAuth tokens, API keys, SMTP passwords, SSO secrets — are encrypted again at field level with AES-256-GCM before they are written, under a key held outside the database.
Access Control
Each workspace's records are scoped to that workspace in the data-access rules, not just the interface. Within a workspace, permissions follow the member's role. Record changes, exports and LP document views are written to an audit log with the acting user, time and, where available, IP address — and audit entries cannot be edited or deleted through the API.
Infrastructure
The platform runs on managed cloud infrastructure, served only over HTTPS. The database runs as a replicated cluster, so losing one machine loses no data. Ask us for the current backup schedule and recovery targets — we will put them in writing rather than on a banner.
Compliance
A SOC 2 Type II audit is in progress; we do not hold a report today, and this page will say so when we do. Our data processing is aligned with GDPR and CCPA, and a Data Processing Agreement — GDPR Article 28, with Standard Contractual Clauses for international transfers — is available. EU data residency available on Enterprise plans.
Monitoring
Sign-in, sign-up and public endpoints are rate limited. An account is locked for ten minutes after five consecutive failed sign-ins. Failed actions are recorded in the workspace audit log, where admins can review them.
Incident Response
Security reports go to security@deelsignal.com. Customers who sign our DPA are notified of a personal data breach affecting their data without undue delay, with what is known about its scope and the steps taken.
DPA and subprocessors
Our Data Processing Agreement template and the full list of vendors that process customer data, with what each receives and where it is located.
Responsible Disclosure
We take security reports seriously and respond within 48 hours. Please disclose responsibly — we do not pursue legal action against good-faith researchers following our disclosure guidelines.
security@deelsignal.comReport a vulnerability
Talk to us about how DeelSignal keeps your fund's data secure, workspace by workspace.