Security
Built for confidential deals from day one.
This page is maintained by PE Dealroom to answer common security and privacy questions. It describes controls currently enabled in the product — not an independent certification.
Tenant isolation
Every table with customer data carries an
org_id. Access is enforced at the database level with Postgres row-level security using is_org_member checks. LPs additionally read only their own fund via a linked-user check — LP A never sees LP B.Authentication
Email + password with leaked-password protection and Google sign-in, with workspace-wide MFA enforcement and configurable idle session timeouts. Roles are stored in a dedicated table (never on user profiles) with a trigger to prevent privilege escalation.
Audit log
Every workspace has an append-only audit trail (
audit_events) scoped to that workspace. Members can review who did what, when. The log itself is protected by the same RLS as the data.Infrastructure
Managed Postgres with automatic backups. Encrypted at rest and in transit. Storage buckets (deal docs, portfolio docs) are private; file paths are namespaced by workspace and gated by policy.
Data portability
Customers can export their entire workspace at any time — JSON per table plus original documents from storage — no lock-in.
Shared responsibility
PE Dealroom operates the platform, keeps controls current, and responds to incidents. Customers manage their own users, roles, and the data they upload. Standard DPA and subprocessor list available on request.
Practices currently in place
- Row-level security enabled on every public table with customer data
- Role storage in a dedicated user_roles table with escalation protection
- RBAC with admin, gp, analyst, approver, and viewer tiers; viewers are enforced read-only at the database layer via triggers
- Workspace-wide MFA enforcement, applied on every server-function call
- Optional MFA requirement per workspace
- Configurable idle session timeout per workspace
- Leaked-password (HIBP) check on signup and password change
- Email confirmation required on signup
- Private storage buckets with per-workspace path scoping
- Append-only audit events per workspace, filterable by category and exportable as CSV
- GDPR/CCPA data-subject request flow with in-app export and deletion request
- Server-side authorization on every mutating server function (not client-only)
- TLS 1.2+ for all traffic; encryption at rest by the managed database
- Automatic database backups
Need more detail?
We can provide our standard DPA, subprocessor list, and answer any procurement questionnaire you send us. For audit-log exports or a custom subdomain, get in touch.
Talk to us