One platform, six stages a deal actually moves through — each one enforced at the database layer, not left to a client-side check.
Disclosure isn't all-or-nothing. A seller defines a named, ordered stage ladder — teaser, detailed diligence, confirmatory, or whatever fits the deal — each stage able to require its own NDA type before content behind it unlocks.
Every access decision, grant or denial, is made for one of a fixed set of specific reasons and is logged with it. Room administrators can see why a person can or cannot open a document; a refused bidder is told only the steps they can act on. Competing bidders are structurally isolated from each other inside the same room — one buyer group cannot see who else is in another, or what they're doing.
Every download is watermarked to the individual viewer by default, and so is every view beyond the first (teaser) stage. Redactions go through a review step before they're baked into a served page — nothing ships without approval. Turning off a room's watermarking, or narrowing its scope, requires a second, independent administrator's sign-off on every plan. An unwatermarked original (native download) is available only on plans that include it, and granting one needs a second administrator on Enterprise and a fresh second-factor check on Pro.
Ad hoc questions and formal diligence requests are two distinct, purpose-built tools — not one thread wearing two hats. A question answered once can be promoted to a shared FAQ visible to every bidder with a single, deliberate decision. Diligence requests carry their own priority and materiality, closer to a ticketing system than a chat.
Every security-relevant action is written to an append-only, hash-chained ledger, sealed daily, so a change to history can be detected; anchoring each seal outside our own database is built and switches on with the production service. MandateRoom can issue a certificate (a preview feature, not yet signed by an independent key service) proving a specific party did not access specific documents in a specific window — and anyone can check that it's genuine, with no account.
Litigation holds block destruction and erasure of anything under hold. A legal export needs the approval of two people besides the person who asks and produces a hashed manifest of the room's sealed snapshot, with a permanent, immutable log of every attempt — approved or denied. Bundling the documents themselves is not built yet. Data subject requests are processed through a formal, auditable workflow.