Security and confidentiality

Confidential data,
encrypted at every layer

GoDeal handles your company’s most sensitive information: accounts, customers, headcount and payroll. That is why every piece of data travels encrypted, is stored encrypted and is seen only by whoever you approve.

TLS in transitAES-256 at restField-level encryptionAccess under NDAImmutable audit trail

Three layers of encryption

The process is encrypted end to end

From the moment you upload your documentation to the moment an investor under NDA opens a document, the data is never exposed.

TLS · HSTS

Encryption in transit

All traffic travels encrypted with TLS, including the real-time chat. HSTS forces HTTPS on every visit: no connection goes out in the clear.

AES-256

Encryption at rest

The database and the data room documents are stored encrypted with AES-256 on European infrastructure (Supabase, AWS eu-west).

AES-256 · VAULT

Field-level encryption

The most sensitive data in your listing — customers, staff, payroll — is encrypted field by field with a key held in a secrets store. The browser can never decrypt it.

Access control

Every piece of data, only for whoever should see it

Permissions are applied row by row in the database. Even if someone tampered with the application, they would see nothing that is not theirs to see.

Public

Visitor

Only the anonymous teaser: sector, region and aggregate metrics. Never the company’s identity.

Under NDA

Investor with an approved NDA

Identity, data room and a direct channel with the adviser. Only after the firm approves their request, one by one.

Owner

Seller

Full control of their mandate: they decide who gets in, what is published, and they can read the complete access audit trail.

Data room audit trail

You know who saw what, and when

Every document upload, download and deletion is written to an insert-only log. Neither the investor, nor the adviser, nor GoDeal can edit it afterwards.

auditoria.godeal.es · data room · immutable log

09:14:02NDA request approved by the adviserverified investor

09:15:31Download · 2024 profit and loss accountsigned link · 1 h

09:15:48Download · Top-20 customer detailrecorded in the audit trail

10:02:17Document uploaded · 2025–2027 projectionsvalidated on the server

10:02:17Action written to the immutable loginsert only

Technical guarantees

Security enforced on the server, not promised on screen

All of these rules are enforced in the database and on the server: they do not depend on what the browser does.

Access only under NDA

Nobody sees your company’s identity or a single document without your express approval. You review every request.

Links that expire

Every data room download uses a single-use signed link that expires in 1 hour. There are no permanent URLs.

Files validated on the server

The server rejects any file that is not a document (PDF, Excel, Word, PowerPoint, CSV) or is larger than 25 MB.

Immutable audit trail

Who uploads, downloads or deletes each document is written to an insert-only log that nobody can edit or delete.

The key never leaves the server

The encryption keys live in a server-side secrets store. The browser cannot decrypt sensitive data.

Permissions in the database

Roles and permissions are checked row by row in the database itself (Row Level Security), not in the browser.

Found a vulnerability?

We appreciate responsible disclosure. Write to us privately at samuel@capittal.es with the details and we will reply as soon as we can.

How the sync works Request firm access

Confidential data,
encrypted at every layer

TLS in transitAES-256 at restField-level encryptionAccess under NDAImmutable audit trail

Confidential data,encrypted at every layer

The process is encrypted end to end

Every piece of data, only for whoever should see it

You know who saw what, and when

Security enforced on the server, not promised on screen

Found a vulnerability?

Confidential data,encrypted at every layer

The process is encrypted end to end

Every piece of data, only for whoever should see it

You know who saw what, and when

Security enforced on the server, not promised on screen

Found a vulnerability?

Confidential data,
encrypted at every layer

Confidential data,
encrypted at every layer