Security

Infrastructure

Switchboard is hosted on Vercel and powered by Supabase for database, authentication, and file storage. Both providers maintain SOC 2 Type II certification and operate on hardened cloud infrastructure. We do not run or manage our own servers.

Data Residency

All customer data — deal content, uploaded documents, and user records — is stored in the United States, in the AWS US East (N. Virginia) region, via Supabase. Data is not replicated outside the US.

Encryption

All data is encrypted in transit over TLS. Data at rest — including deal content, uploaded documents, and user records — is encrypted by Supabase using AES-256. Document files are stored in an isolated storage bucket and are never accessible via direct URLs; all access requires a short-lived signed URL generated server-side.

Authentication

Users authenticate via email magic link or password. Passwords require a minimum of 8 characters, consistent with NIST SP 800-63B guidance. Multi-factor authentication (TOTP, compatible with standard authenticator apps) is available to all users and can be enabled from account settings. Sessions are managed server-side using secure, HTTP-only cookies and are automatically refreshed.

Invitations are single-use, time-limited links delivered by email. Accepting an invitation requires the recipient to be authenticated, preventing link-forwarding abuse.

SAML single sign-on (Okta, Microsoft Entra ID) is on our enterprise roadmap.

Access Control

Access is enforced at multiple layers:

• Role-based access — every user has an explicit role (project lead, workstream lead, SME, or target). Roles determine what actions are available across the platform.
• Per-subject-matter access — write access is scoped to assigned subject matters. Users may have read-only visibility into subject matters outside their assignments depending on their role, but cannot modify content they have not been granted explicit write access to.
• Database-level enforcement — access rules are additionally enforced directly in the database using Postgres row-level security (RLS) policies, providing an independent layer of protection beneath the application. Counterparty (target) users in particular are isolated at the database level: the database itself rejects reads and writes outside the material assigned to them.
• Server-side privilege escalation — operations requiring elevated permissions (sending invites, publishing sections, writing activity logs) use a server-only service role key that is never exposed to the browser.
• Administrative access — access to infrastructure administration consoles (database, hosting, monitoring) is restricted to a small number of senior personnel. A defined escalation path governs when and how that access is exercised.

Document Security

Uploaded documents are stored in a private, deal-scoped storage bucket. Access requires an authenticated session and an active deal membership. There are no persistent public links to any document — file bytes are only ever served through a server-side route that re-verifies the viewer's permissions on every request.

Project leads can additionally set a per-document access level:

• Download — the document can be viewed and downloaded normally.
• Watermarked— PDFs are stamped with the viewing user's identity at the moment of access, so any copy that leaves the platform is traceable to the individual who obtained it.
• View only — the document can be read in the in-browser viewer but never downloaded or exported.

These levels are enforced server-side everywhere document bytes can leave the platform, including bulk deal exports.

Audit Trail

Every deal maintains an append-only activity log. Entries are written server-side and cannot be edited or deleted through the application. The log records:

• Every document view and download, per user, with timestamps
• Bulk deal exports, including format and file count
• Every permission change — role changes, access grants and revocations, admin privileges
• Team membership changes and invitations
• Content lifecycle events — uploads, answers, approvals, releases, and clarification threads

Deal team members can review the full trail on the deal timeline and export it to CSV at any time — including the complete who-accessed-what document history.

Backups & Disaster Recovery

The production database is backed up automatically every day, with encrypted backups retained on a rolling window. Backup and restore infrastructure is managed by Supabase as part of their SOC 2-audited platform.

Data Retention & Deletion

When a user deletes their account, their sign-in credentials and authentication data are permanently deleted and their email address is removed from our records. Their contributions to deals — answers, documents, messages, and audit entries — are retained, because M&A due diligence records must remain complete and attributable for legal purposes (consistent with GDPR Article 17(3)(e)).

Deals themselves can be deleted by a deal administrator. Deleted data ages out of provider backups automatically at the end of the backup retention window.

Subprocessors

We share data with a small number of infrastructure providers, each bound by their own security and data-processing commitments:

• Supabase (SOC 2 Type II) — database, authentication, and file storage. Stores all customer data.
• Vercel (SOC 2 Type II) — application hosting and content delivery. Processes requests in transit; does not persist customer data.
• Sentry — error monitoring. Receives stack traces and technical diagnostics only; configured to exclude user content and personal data from error reports.
• Resend — transactional email (invitations and notifications). Receives recipient email addresses and message content of the emails we send.

Development Practices

All code changes are reviewed before deployment. Our automated test suite exercises the database access policies directly — verifying not only that authorized users can access what they should, but that every unauthorized role is rejected at the database level. Dependencies are audited for known vulnerabilities and patched promptly.

Monitoring

Application errors and exceptions are captured in real time using Sentry. All mutating server actions log errors for audit purposes. Vercel provides request-level logging and infrastructure monitoring.

Incident Response

We monitor for incidents through real-time error tracking, our audit logs, and contractual breach-notification obligations from our infrastructure providers. If we become aware of a confirmed breach affecting your data, we will notify affected customers within 72 hours, including what happened, what data was involved, and what we are doing about it.

Reporting a Security Issue

If you discover a potential security vulnerability, please report it to us directly at security@switchboarddeals.com. We will respond promptly and work with you to address the issue. A machine-readable security contact is published at /.well-known/security.txt.