Security and compliance
How DealBridge protects the deal data your desk puts into it, and what your security team can have from us.
Where we stand
DealBridge's controls are designed against the SOC 2 Trust Services Criteria, and we are working towards a SOC 2 Type II report.
We do not yet hold a SOC 2 report or ISO 27001 certification. Until we do, we complete security questionnaires and share our policies under NDA, so your team can assess the controls directly.
How the platform is protected
Hosted in the UK
The platform and its data run on Microsoft Azure, in the UK South region.
Encrypted in transit and at rest
Connections use TLS 1.2 or 1.3 only, with older versions refused, and data is encrypted where it is stored.
Multi-factor sign-in
Accounts are set up for named people, never by self-registration, and sign-in uses multi-factor authentication.
Access by role
Permissions are set by role, so administrators, coordinators and each bookrunner on a syndicated deal work within their own.
A complete audit trail
Every action is timestamped and attributed to a named user, and the full record exports in one click.
Penetration tested, code reviewed
The platform has been penetration tested externally with Pentest-Tools.com, and its full source code is reviewed for security flaws on a regular cycle using Anthropic's current frontier Claude models.
Backed up
Complete backups are taken regularly, so the platform and its data can be restored.
Incidents reported, not buried
We run an incident response process, and we tell affected clients about a personal data breach without undue delay, as UK GDPR requires.
Vetted staff
Research Tree staff are vetted before they are given access to client data.
Data protection
We process client data under UK GDPR and the Data Protection Act 2018, as the DealBridge agreement sets out. Our data processing agreement is available to clients and to firms evaluating DealBridge.
Sub-processors
Two third parties process client data for DealBridge.
Microsoft Azure
Microsoft
- What it does
- Hosts the platform and stores its data.
- Where
- United Kingdom (UK South region)
Mandrill
Intuit Mailchimp
- What it does
- Delivers the emails the platform sends.
- Where
- United States, under Mailchimp's data processing addendum
What your security team can have
- Your security questionnaire, completed
- Our information security policies, under NDA
- Our data processing agreement
DealBridge
Try it on three transactions, free
No obligation. Book a demo and we will set your desk up in a test environment.