Security we'll actually explain.
No trust-badge wall. The founder spent a past life as a cybersecurity engineer, so this page says what is in place, what is not yet, and who to email when you find something.
// 01Encryption and isolation
- AES-256 at rest, TLS 1.3 in transit, on every route including the API.
- Single-tenant row isolation: every query is scoped to your workspace at the data layer, not just in the UI.
- Secrets and BYOK keys are stored encrypted and are never rendered back to the browser after they are saved.
// 02Accounts and access
- Passwords hashed with scrypt. TOTP two-factor available on every tier, with single-use recovery codes.
- Sessions are same-origin, expire on inactivity, and can be revoked from Settings.
- SSO and SAML with directory sync are Enterprise.
- Least privilege on our side: production access is limited to the few people who need it and is audit-logged.
- No standing access. Database access is just-in-time and expires automatically.
// 03Call audio and recordings
- A consent gate runs before anything records, and the consent event is logged with the call.
- The recorder produces a transcript and discards the audio. Nothing is stored on our side.
- Field-locked deals stay out of the public leaderboard entirely.
// 04AI and vendor handling
- Model calls are transient. No training on your records, by us or by the provider.
- Enrichment vendors receive only the field needed for the lookup, and every returned value carries its source.
- Bring your own keys on Enterprise and the traffic goes through your provider account.
// 05Backups and continuity
- Encrypted daily backups with a 35-day roll-off, restore tested quarterly.
- 99.9% uptime target, stated as a target and tracked publicly rather than sold as a badge.
- Runs on SOC 2 / ISO 27001-certified, US-based infrastructure providers, with separate, isolated environments for production, staging, and development.
// 06Incidents
- Anything that touches customer data gets a written note in the changelog the same week.
- Affected accounts are emailed directly, with what happened, what we did, and what changed afterwards.
// 07Subprocessors
We use a small set of vetted providers to run the product. We list them by category here on purpose and don't publish vendor names on the open web.
| Category | Purpose | Region | Data touched |
|---|---|---|---|
| Infrastructure & hosting | App and database hosting | US | All CRM data (encrypted) |
| AI inference | Optional AI features | US | Prompt content (zero-retention) |
| Payments | Billing & subscriptions | US | Email, card token (held by processor) |
| Email delivery | Transactional account email | US | Email address, message body |
| Telephony | The dialer | US only | Call audio in flight, phone numbers |
The current, named subprocessor list and our DPA go to customers and prospects under NDA on request. We don't post them publicly, because an attacker's first move is mapping your vendors.
// 08Not yet, and we will say so
- SOC 2 Type II is not done. The audit starts once Pro revenue covers it, and the date will be posted when it is booked.
- No bug-bounty program yet, but reports are still answered and credited.
- Penetration testing is annual and internal for now; the first third-party test is scheduled alongside SOC 2.
- Not HIPAA or PCI certified. Don't store health records or raw card numbers in DealArena.
- No security is perfect. We patch fast, we disclose honestly, and we'd rather tell you than spin you.
// 09The dead-man's switch
DealArena is built by a very small team, so we plan for the worst case with a documented dead-man's switch instead of pretending it away.
- Your data is never trapped. Daily encrypted backups plus one-click export mean you can walk out with everything at any time.
- A dead-man's switch. If the team goes dark, a documented switch fires automatically and a trusted second party triggers an orderly export window and wind-down.
- You get a runway. If the service is ever shut down, you get at least 30 days' notice and a full export window before anything is deleted.
// 10Report a vulnerability
Report it and you get a human, fast.
Email the details to security@dealarena.io. Acknowledged within 24 hours, triaged the same week, and credited in the changelog if you want the credit.
security@dealarena.io →Safe harbour. Good-faith research is welcome and we won't pursue legal action for it. Please don't run automated scans against production or touch data that isn't yours.
// DealArena LLC · 1007 Boyd Street, Baltimore, MD 21223 · governed by Delaware law
// named subprocessor list & DPA available to customers under NDA on request
// p.s. that encrypted line just above? give it a click.