Security

Infrastructure Security

Provided by our infrastructure partners

• AES-256 encryption at rest — Cloudflare R2
• TLS encryption in transit — Vercel and Cloudflare
• SOC 2 certified infrastructure — Cloudflare, Vercel, and Supabase each hold independent SOC 2 certifications
• File conversion (CloudConvert) — DOCX, PPTX, XLSX, and similar documents are converted server-side via CloudConvert API before rendering as watermarked images. Document content is processed in transit and never stored by CloudConvert beyond the conversion task. CloudConvert is ISO 27001 certified (TÜV Süd, Lunaweb GmbH) and operates under GDPR-compliant data processing terms.
• Rate limiting — Upstash Redis enforces sliding window rate limits on authentication and submission endpoints to prevent brute force attacks and abuse

Application Security

Built into MandateRoom

• Cryptographically signed audit log (HMAC-SHA256) — every access event is signed; tampering is mathematically detectable
• Dynamic watermarking and server-side rendering — documents are rendered server-side and every page contains the viewer's email, IP address, and timestamp. Original files never reach the browser.
• Unified authorization layer — every protected route enforces active session validity, role membership, NDA acceptance, MFA level, and IP whitelist rules before any room data is accessed.
• Role-based access controls — admin, reviewer, and viewer roles with per-document permission enforcement
• Instant access revocation — removing a member blocks access on the next request, no cache residual
• Multi-factor authentication (TOTP) — time-based one-time passwords enforced at account level and optionally required per data room; MFA level verified server-side on every protected request.
• NDA acceptance tracking — timestamp and IP address recorded at the moment of acceptance
• IP address whitelisting — restrict access to specified IP addresses; members connecting from any unlisted IP are denied access on every request regardless of valid session
• Append-only audit log — database-level trigger prevents any modification or deletion of audit records
• Account lockout — five consecutive failed login attempts locks the account; lockout state is enforced server-side and recorded in the audit log.
• Participant group isolation — competing parties are isolated through two independent layers: application-level checks on every request, and a separate PostgreSQL Row-Level Security policy at the database layer. Neither layer depends on the other being correct.
• Folder-level access restrictions — admins can restrict specific folders from specific participant groups. Restricted folders are invisible to restricted groups — they cannot see the folder exists. Restrictions apply to both viewer and reviewer roles within the restricted group.
• Per-document download controls — admins can grant or revoke watermarked PDF download permission on a per-document basis, overriding the role-level default. This allows selective sharing of downloadable documents without changing a member's broader access level.
• Structured Q&A with answer gating — questions from participant groups are siloed; answers require admin review before publication; internal notes are never exposed to external participants, enforced at database level
• File upload security — uploaded files are validated by extension and server-side MIME type detection; ZIP archives are protected against directory traversal and decompression attacks
• Q&A record integrity — archived rooms are frozen at the database level; no modifications to questions or answers are permitted after the room is archived.

Independent Security Testing

Last tested: July 2026 — re-tested whenever a meaningful change to the product warrants it, not on a fixed schedule we might not sustain.

Most vendors ask you to take their word for it. We would rather show you the actual results.

TLS / Certificate Configuration — SSL Labs (Qualys)

Independently verified: valid certificate, correctly issued, properly chained to a trusted root, not revoked.

HTTP Security Headers — securityheaders.com

Grade: A. Clickjacking protection, MIME-sniffing prevention, and strict transport security all independently confirmed present and correctly configured.

Live Application Security Testing — OWASP ZAP

93,000+ simulated attack requests run directly against the live application using the industry-standard open-source penetration testing tool. Zero high-severity findings.

Performance, Best Practices & SEO — Google Lighthouse

100 Performance, 100 Best Practices, 100 SEO, 87 Accessibility — independently measured, not self-reported.

Happy to walk any prospective customer through the actual results in detail, not just this summary.

What we do not have

We believe honesty builds more trust than inflated claims.

• We are not SOC 2 certified
• We do not have a dedicated security team
• We do not have 24/7 security monitoring
• We do not carry cyber liability insurance
• MandateRoom is a solo-operated product