+ Self-Assessment · Type II Audit Planned Q4 2026
+
+
+ SOC 2 Compliance
+
+
+ Dealspace has completed a comprehensive SOC 2 Type II self-assessment. We are preparing for formal audit certification in Q4 2026.
+
+
+
+
+
+
+
+
+ Note: This is a self-assessment document. Formal SOC 2 Type II audit is planned for Q4 2026.
+
+
+
+
+
+
+
+
+
+
Overview
+
What is SOC 2?
+
+ SOC 2 (System and Organization Controls 2) is an auditing framework developed by the AICPA that evaluates how organizations manage customer data based on five Trust Services Criteria.
+
+
+ For M&A platforms handling confidential deal data, SOC 2 compliance demonstrates a commitment to security, availability, and data protection that investment banks and advisors require.
+
+
+
+
Self-Assessment Summary
+
+
+ Security (CC1-CC9)
+
+
+
+
+ 95%
+
+
+
+ Availability (A1)
+
+
+
+
+ 95%
+
+
+
+ Confidentiality (C1)
+
+
+
+
+ 98%
+
+
+
+ Processing Integrity (PI1)
+
+
+
+
+ 95%
+
+
+
+ Privacy (P1-P8)
+
+
+
+
+ 95%
+
+
+
+
+
Assessment Date: February 28, 2026
+
+
+
+
+
+
+
+
+
+
+
Scope
+
What's Covered
+
+ Our SOC 2 assessment covers all aspects of the Dealspace platform and infrastructure.
+
+
+
+
+
+
+
+
+
Infrastructure
+
+
• Production server (Zürich, Switzerland)
+
• Go application binary
+
• SQLite encrypted database
+
• Caddy reverse proxy
+
+
+
+
+
+
+
+
Data Types
+
+
• M&A deal documents
+
• Financial data
+
• Transaction details
+
• Participant information
+
+
+
+
+
+
+
+
User Types
+
+
• Investment bank admins/members
+
• Seller organizations
+
• Buyer organizations
+
• Observers
+
+
+
+
+
+
+
+
+
+
+
Trust Services Criteria
+
The Five Pillars
+
+ SOC 2 evaluates organizations against five Trust Services Criteria. Dealspace implements controls for all five.
+
+
+
+
+
+
+
+
+
+
+
+
Security (CC1-CC9)
+
Protection against unauthorized access, both physical and logical.
+
+
+
+ FIPS 140-3 encryption (AES-256-GCM)
+
+
+
+ Per-project key derivation (HKDF-SHA256)
+
+
+
+ Role-based access control (RBAC)
+
+
+
+ MFA required for IB users
+
+
+
+
+
+
+
+
+
+
+
+
+
+
Availability (A1)
+
Systems are available for operation and use as committed.
+
+
+
+ 99.9% uptime SLA
+
+
+
+ 4-hour recovery time objective
+
+
+
+ Daily encrypted backups
+
+
+
+ Swiss data center (Zürich)
+
+
+
+
+
+
+
+
+
+
+
+
+
+
Confidentiality (C1)
+
Information designated as confidential is protected as committed.
+
+
+
+ All deal data encrypted at rest
+
+
+
+ Blind indexes for searchable encryption
+
+
+
+ TLS 1.3 for all connections
+
+
+
+ Dynamic document watermarking
+
+
+
+
+
+
+
+
+
+
+
+
+
+
Processing Integrity (PI1)
+
System processing is complete, valid, accurate, timely, and authorized.
+
+
+
+ Input validation on all data
+
+
+
+ Parameterized SQL queries
+
+
+
+ Optimistic locking (ETag)
+
+
+
+ ACID transaction compliance
+
+
+
+
+
+
+
+
+
+
+
+
+
+
Privacy (P1-P8)
+
Personal information is collected, used, retained, and disclosed in conformity with commitments.
+
+
+
+ GDPR/FADP/CCPA compliant
+
+
+
+ Data export on request
+
+
+
+ No third-party tracking
+
+
+
+ No data sales
+
+
+
+
+
+
+
+
+
+
+
+
+
+
Controls Summary
+
Key Security Controls
+
+
+
+
+
Encryption
+
FIPS 140-3 validated AES-256-GCM with per-project keys derived via HKDF-SHA256
+
+
+
Authentication
+
JWT tokens with 1-hour expiry, MFA required for IB users, session management