Every statement this site makes about security is a row below: its wording, its level of proof, the environment it was checked in and the date. Nothing here is a certification, and nothing has been checked on a production service yet.
Registry read on .
No claim is above E4: nothing has been checked on a production service, and nothing has been examined by an independent party.
Each row was checked in our own test environment on the date shown. The level says how hard it was checked.
| Claim | Proof | Checked in | Last verified |
|---|---|---|---|
| Access control | |||
| ACC-001Every deal room is isolated at the database layer, not only in the application: row-level security is forced on every table, so a mistake in a screen cannot show one room's data to another.What a person can reach through the screens and the API. It does not cover what a person does with a file once they hold it. | E3 | Verified Local | |
| ACC-002A logged-out visitor can read public information (the price list and the published terms) and check a certificate. Nothing inside a deal room is reachable without a signed-in session.The list of what a logged-out visitor may read or call was read from the live catalog; no test has yet acted as a logged-out visitor against a room. | E1 | Verified Local | |
| ACC-003Competing bidders are structurally isolated from each other inside the same room: one buyer group cannot see who else is in another, or what they are doing. | E3 | Verified Local | |
| ACC-004Every access decision, grant or denial, is made for one of a fixed set of specific reasons and is logged with it. Room administrators can see why a person can or cannot open a document; a refused bidder is told only the steps they can act on.A bidder who is refused for any other reason is told only that the document is not available. | E3 | Verified Local | |
| ACC-005Turning off multi-factor authentication, turning off a room's watermarking or narrowing its scope, or clearing an IP allowlist requires a second, independent administrator's sign-off on every plan, enforced by the database, not a checkbox.Proven by probes that act as two administrators on a Starter, a Pro and an Enterprise room, each with its guards removed in turn so that the probe fails: the three security settings, and, since 9 October 2026, narrowing the watermark's scope on Pro and Enterprise. High-risk access grants are covered by ACC-007. | E3 | Verified Local | |
| ACC-006SMS-based two-factor authentication is not offered, by design: it is a known-weak factor we will not offer even as an option. | E2 | Verified Local | |
| ACC-007Enterprise adds dual-control approval of high-risk access grants; on Starter and Pro those grants need a fresh second-factor check instead.A high-risk grant is one that widens access and includes the original file (native download), or opens several folders or a large folder at once. On Pro it needs a fresh second-factor check, not a second administrator. | E3 | Verified Local | |
| Content protection | |||
| CNT-001Every download is watermarked to the individual by default, and so is every view beyond the first (teaser) disclosure stage, not as an administrator's opt-in choice.Watermarking deters and attributes unauthorized redistribution. It is not a claim that screenshots or photographs are impossible. A second administrator can approve turning a room's watermarking off or narrowing its scope (ACC-005); an original file granted as a native download carries no watermark (CNT-004). | E3 | Verified Local | |
| CNT-002Redactions go through a review step before they are baked into a served page: nothing is redacted by guesswork, and nothing ships without approval. | E3 | Verified Local | |
| CNT-003Search results are scoped to what you are allowed to see before they are returned: a search cannot reveal that a document you do not have access to exists. | E3 | Verified Local | |
| CNT-004Clean Team documents are always watermarked on every page and offer no download, print or export. Where a plan includes native download, an administrator can grant the original file, which carries no watermark.Granting an original file is a high-risk grant (ACC-007). The original carries no watermark; the access ledger still records who was given it. | E3 | Verified Local | |
| Audit and evidence | |||
| AUD-001Every security-relevant action is written to an append-only, hash-chained ledger that is cryptographically sealed once a day, so a change to history can be detected.Tamper-evident, not independently anchored: the outside copy of each daily seal is listed below as pending. | E2 | Verified Local | |
| AUD-002NDA acceptance captures the exact text a named person agreed to, at the exact moment, from the IP address they used. | E4 | Verified Local | |
| AUD-003A room's own administrators can preview the room exactly as a bidder sees it. The preview is time-boxed, fully logged, and cannot write or alter anything. | E3 | Verified Local | |
| AUD-004A legal export needs the approval of two people besides the person who asks and produces a hashed manifest of the room's sealed snapshot, with a permanent, immutable log of every attempt — approved or denied.A legal export holds the manifest and nothing else: not the documents, not the pages, not the audit events themselves (see the entry for document export bundles below). A request for a load-file format is accepted and gives the same manifest. | E3 | Verified Local | |
| AUD-006Litigation holds block destruction and erasure of anything under hold.Checked against the live catalog and by one test of an erasure held back by a hold and carried out when the hold ends; no test has yet tried to destroy a room under hold. | E1 | Verified Local | |
| CRT-001MandateRoom can issue a certificate proving a specific party did not access specific documents in a specific window, and anyone, with no account, can check that it is genuine. Certificates are a preview feature: they are not yet signed by an independent key service.The signing key is a local stand-in, and there is no independent timestamp authority yet. | E2 | Verified Local | |
| Verification | |||
| VER-001The platform runs continuous, automated verification of its own security controls on a fixed schedule — not only when someone remembers to check.It covers the controls the platform can examine in itself. It does not replace an independent examination. | E1 | Verified Local | |
| Privacy and data | |||
| PRV-001Data subject requests are processed through a formal, auditable workflow. Erasure is enforced by destroying the encryption key that makes personal data readable, not a soft-delete flag.A record kept as evidence is made unreadable, not removed; a legal hold or a legal minimum comes first. | E1 | Verified Local | |
We do not claim these. Each needs the production service, which has not opened.
| Item | Proof so far | Needs | Where it stands |
|---|---|---|---|
| AUD-005An outside copy of each day's ledger seal, in storage that cannot be altered or deleted. | E1 | Pending Hosted | Built and tested on our test stack with a stand-in for the storage. It is not running on the production service, so today the ledger is tamper-evident, not independently anchored. |
| CRT-002Certificates signed by an independent key service, with a trusted timestamp. | E0 | Pending Hosted | Not built. Today a stand-in signs, on our own machine, with a timestamp that is not an independent authority's. |
| OPS-001Every statement above checked again on the production service. | E0 | Pending Hosted | The production service has not opened. Everything above was checked in our own test environment. |
Said plainly, so that nobody has to ask. When one of these changes, the row changes on the day it does.
| Item | Status | Where it stands |
|---|---|---|
| ASR-001SOC 2 Type I report | Not held | On our roadmap. No audit has started. |
| ASR-002SOC 2 Type II report | Not held | On our roadmap. No audit has started. |
| ASR-003ISO/IEC 27001 certificate | Not held | On our roadmap. No audit has started. |
| ASR-004Independent penetration test | Not held | None has been done. Our own verification programme is not a substitute and is not described as one. |
| ASR-005Malware scanning of uploaded files | Not held | No scanner is connected. Files are not scanned, and the Acceptable Use Policy says so. |
| ASR-006Encryption keys held by the customer | Not held | There are none. The service holds the keys that let it open your documents, which is why it can convert, search and watermark them. |
| ASR-007Export of a room's documents for e-discovery tools (a PDF bundle, or native files with a load file) | Not held | Not built. A legal export is a hashed manifest of the room's sealed snapshot; the documents themselves are not bundled into it and no load file is produced, whatever format is asked for. |
Our architecture is built around the control objectives SOC 2 and ISO 27001 evaluate, as the security architecture describes. We will change these rows the moment a real engagement starts, with a real date, and not before.
This table is made from one list. The site is built from that list too, and the build refuses to publish when it is wrong: when a claim is shown as verified but needs the production service and has only been checked in our test environment; when something we do not have is claimed anywhere else on the site; when a sentence on another page no longer matches its row. It checks the list against itself and the pages. It cannot tell whether a page's prose is true, which is why every row names what it was checked against.
To challenge a row, write to hello@mandateroom.com. To report a vulnerability, read the Vulnerability Disclosure Policy; our contact details for reports are also published at /.well-known/security.txt. The providers that process personal data for us, what each one handles and where, are on the Sub-processors page.