Security

Enforced server-side

Access control runs on the server, on every request. The interface never gets to decide.

• Phased disclosure. Every document carries a minimum phase (1–3); every investor carries a phase. The server filters listings, folder contents, counts, search, and the AI's context by phase on every request. A direct request for a document above the investor's phase returns a 404 response byte-identical to one for a document that does not exist — never a 403 that confirms something is being withheld. An investor cannot infer that undisclosed documents exist.

• Tenant isolation. Every database query is scoped to the tenant taken from the server-side session, never from the request. Middleware rejects requests without a valid, active tenant before any handler runs.

• Role-based access. Roles are database-constrained (admin, user, investor); administrative actions require the admin role and are rejected otherwise. Platform administration is a separate route group behind its own authorization layer, segregated from tenant traffic.

• Platform administrator access. Platform administrators cannot set a user's password and cannot access tenant document content or metadata through the product. Document routes are tenant-scoped and a platform session carries no tenant, so a platform administrator's request for a document listing is refused outright, not filtered or emptied. Administrative actions are audit-logged, and a user is notified when a platform administrator initiates a password reset on their account; the platform administrator never sees the resulting credential.

• Infrastructure-level access is a separate question. The guarantees above are about the product surface. Infrastructure access is held by a small number of named individuals, who can read the underlying database and file storage directly through Cloudflare's dashboard and CLI, and Cloudflare, as the infrastructure provider, retains its own operational access — neither is restricted by anything the product enforces. We say so here rather than claim otherwise.

• View-only decisions are made server-side. For every document view or download, the server decides between serving the original, serving a watermarked copy, or refusing — based on tenant defaults and per-document overrides. Disabling a button in the UI is not the control; the server check is.

Document protection

• Per-investor watermarking. View-only PDFs are watermarked on the server before a byte leaves it: the viewer's name, email, and a timestamp are burned into every page. A PDF that cannot be fully watermarked is refused — it is never served partially stamped or unstamped.

• Per-document download control. Each document can override the tenant default: force view-only or allow download, decided server-side at request time.

• AI exclusion. Any document can be excluded from the AI's context. The AI can state that the document exists; it never sees the content.

• Hide, not lock. As above: documents above an investor's phase are absent from every listing, count, search result, and AI answer, and return an indistinguishable 404 on direct fetch.

Retention and deletion

• Deleting a document permanently removes the file, its extracted text, its watermarked copies, and its AI index entries within seconds. There is no undelete.

• On cancellation, data is retained for 30 days with export available throughout, after three notices, and then permanently deleted. Tenant admins keep full read and export access for the whole retention window; investors lose access immediately. Notices go out on day 0, day 15, and day 23, each stating the deletion date and linking to export.

• A failed payment is not a cancellation and never starts the deletion clock. Access is suspended: investors lose access, and tenant admins keep read and export access so they can retrieve their documents at any time. Restoring payment restores full access immediately.

• We hold no backup of your documents. Once deleted, whether by you or at the end of a retention window, they cannot be recovered.

Authentication

• Passwords are hashed with PBKDF2-SHA256 at 100,000 iterations with a per-user random salt, and verified with a constant-time comparison. We never store or transmit a plaintext password.

• Sessions are signed tokens (HMAC-SHA256) that expire after 24 hours, delivered in httpOnly cookies. State-changing requests require a CSRF token. Cross-origin API clients authenticate with a bearer token instead.

• Logging out revokes the session token on the server immediately, ahead of its natural expiry.

• Changing or resetting a password immediately invalidates every other session for that account.

• Repeated failed logins from an address back off exponentially: lockouts step up from 30 seconds to 30 minutes.

• Password policy: 12–128 characters, requiring an uppercase letter, a lowercase letter, a digit, and a symbol. Commonly used passwords are rejected outright. Applies to new and changed passwords.

Rate limiting

Rate limits are enforced in Cloudflare KV per user or IP address, and fail closed: if the rate-limit store is unavailable, requests are denied, not waved through.

Request bodies are capped at 1 MB for JSON and 50 MB for uploads.

Audit and monitoring

• Authentication events — logins, failed logins, password changes and resets, user creation — and bulk data room exports are recorded with user attribution.

• Platform-administrator actions on a tenant — tenant changes, user changes, password reset triggers — are recorded in that tenant's own audit log.

• Engagement analytics per investor: sessions, documents viewed and downloaded, and questions asked, visible to tenant admins in the dashboard.

• Tenant admins receive a daily digest email covering the past 24 hours: logins, questions asked, document activity, and any processing failures.

Coverage is not complete: not every write operation is logged yet, and there is no in-product viewer for the audit log — both are on the gaps list below.

Infrastructure

• Runs entirely on Cloudflare: Workers (compute), D1 (database), R2 (document storage). Data is encrypted at rest and in transit.

• The database runs in Cloudflare's Eastern North America region. We do not claim multi-region redundancy.

• Secrets live in Cloudflare's encrypted secret store, not in code or configuration files.

• No third-party analytics or tracking scripts anywhere on the product or this site.

AI processing

Document content is sent to Anthropic's Claude API at two points: once at upload, for analysis and summarization, and once per question, to answer with the most relevant documents. Under Anthropic's Commercial Terms, customer content is never used to train models, and for the models we use, inputs and outputs are not retained by Anthropic by default — verified against our account's terms, not just the published policy. Everything derived from your documents — extracted text, summaries, the search index — is stored in our Cloudflare infrastructure, not at Anthropic. Content flagged by Anthropic's automated trust and safety systems may be retained longer, as set out in their terms.

Subprocessors

Each subprocessor operates under a data processing agreement incorporating Standard Contractual Clauses — Anthropic's is part of its Commercial Terms; Cloudflare, Resend, and Stripe publish their own. A customer-facing DPA for yourdataroom.app is not yet available; it is listed in the gaps table, alongside EU data residency.