Every claim on this page is specific and checkable — not because vague claims wouldn't sound impressive, but because the people evaluating a data room for a live deal are trained to discount the ones that are.
Access control
Every deal room is isolated at the database layer, not only in the application: row-level security is forced on every table, so a mistake in a screen cannot show one room's data to another.
A logged-out visitor can read public information (the price list and the published terms) and check a certificate. Nothing inside a deal room is reachable without a signed-in session.
What a logged-out visitor can read or run is a short, fixed list, made up of public reference information and a few small helper functions, and none of it is room data. A check that runs every day reports it as a critical finding if anything is ever added to that list.
Every access decision, grant or denial, is made for one of a fixed set of specific reasons and is logged with it. Room administrators can see why a person can or cannot open a document; a refused bidder is told only the steps they can act on.
A room goes live only when its super administrator takes it live, and that asks for a fresh passkey or authenticator code. An administrator of the room can prepare it but cannot take it live. A practice room, which holds only made-up data, asks for no second factor.
Content protection
Every download is watermarked to the individual by default, and so is every view beyond the first (teaser) disclosure stage — not an admin's opt-in choice.
Clean Team documents are always watermarked on every page and offer no download, print or export. Where a plan includes native download, an administrator can grant the original file, which carries no watermark.
Watermarking deters and attributes unauthorized redistribution. It is not a claim that screenshots or photographs are impossible — no vendor's is.
Turning off a room's multi-factor authentication or watermarking, narrowing the watermark's scope, or clearing its IP allowlist, requires a second, independent administrator's sign-off on every plan — enforced by the database, not a checkbox.
Enterprise adds dual-control approval of high-risk access grants; on Starter and Pro those grants need a fresh second-factor check instead.
An administrator of a room can stop the opening of its documents and its deal brief at once, for every bidder or for everyone except the super administrator, on every plan. Download addresses issued before the stop are refused. A bidder is not told that a stop is on, or why. Only the room's super administrator can lift it, and must confirm with a passkey or an authenticator code. Stopping and lifting are each written to the room's record.
Audit & evidence
Every security-relevant action is written to an append-only, hash-chained ledger that is cryptographically sealed once a day, so a change to history can be detected. Anchoring each day's seal outside our own database is built and switches on with the production service; until then the ledger is tamper-evident, not independently anchored.
NDA acceptance captures the exact text a named person agreed to, at the exact moment, from the IP address they used.
On Enterprise, an administrator can download a room's record as a file that holds each entry's number, kind, time, fingerprint and identifiers, and no names and none of the details of what was done. A short program that needs nothing from MandateRoom can check that file: it recomputes every entry's fingerprint, its link to the entry before it and the numbering, and names the first entry that does not hold. Downloading the file is itself written to the room's record.
A room's own administrators can preview the room exactly as a bidder sees it. The preview is time-boxed, fully logged, and physically cannot write or alter anything.
Continuous verification
The platform runs continuous, automated verification of its own security controls on a fixed schedule — not only when someone remembers to check.
The daily check also looks at itself: it reports a critical finding if it can no longer see the access grants it examines, and if one of its own checks has been written so that it could never find anything.
Litigation holds block destruction and erasure of anything under hold. A legal export needs the approval of two people besides the person who asks and produces a hashed manifest of the room's sealed snapshot, with a permanent, immutable log of every attempt — approved or denied. Bundling the documents themselves is not built yet.
Data subject requests are processed through a formal, auditable workflow. Erasure is enforced by destroying the encryption key that makes personal data readable, not a soft-delete flag.
Verify a certificate yourself
MandateRoom can issue a certificate proving a specific party did not access specific documents in a specific window — and anyone, with no account, can check that it's genuine. Certificates are a preview feature: they are not yet signed by an independent key service.
We haven't completed a third-party security certification yet, and no audit has started. Formal certification is on our roadmap — we'll say so plainly, with a real date, once one is actually underway, not before. We do not yet scan uploaded files for malware, and the production service has not opened: what is stated on this page is what the product does in our own test environment, and we will say so on the Trust Center when it has been checked on the live service. See the Trust Center for the full certification-status table.