Arendel hosts confidential M&A deal data. We take that responsibility seriously. This page summarizes the controls we have in place. Last updated: July 2026.
Identity & access
✓Role-based access control. Every account belongs to an organization. Within that org, users hold one of four roles: Owner, Admin, Member, Guest. Permissions cascade — an Owner can do everything an Admin can, and so on.
✓Per-deal granular permissions. External advisors (outside counsel, QoE firm, lenders) can be scoped to a single deal with view-only, edit, or admin rights — never your full pipeline.
✓Two-factor authentication. Available to every user via authenticator app, SMS, or hardware security key. Owners can enforce 2FA for their entire firm.
✓Single sign-on (SSO). SAML 2.0 SSO is available on our Enterprise tier with Okta, Azure AD, Google Workspace, and any other SAML-compatible identity provider.
✓Session management. Sessions expire after a configurable timeout. Owners can enforce shorter timeouts at the org level. /reset clears all session cookies.
Data isolation
✓Strict org scoping. Every database query is scoped to the requesting user's organization. We enforce this at the application layer today and are rolling out database-level Row-Level Security (RLS) as an additional defense.
✓Document confidentiality tiers. Each document can be marked Normal or Confidential. Confidential docs are hidden from non-Owner deal members regardless of deal access.
✓Per-org storage prefix. Document blobs are stored in Cloudflare R2 under per-organization prefixes. An org's documents are never co-mingled with another's at the object-key level.
✓Per-deal financial visibility. Purchase price, capital structure, and other deal economics can be hidden from non-Owner deal members on a per-deal basis.
Encryption
✓Encryption in transit. All traffic to and from Arendel is encrypted with TLS 1.2 or higher. We support modern cipher suites only; legacy SSLv3/TLS 1.0/TLS 1.1 are disabled. HSTS is enforced.
✓Encryption at rest. Database storage (Neon Postgres) and object storage (Cloudflare R2) both encrypt data at rest with AES-256.
✓Field-level encryption on the most sensitive financial fields (purchase price, EBITDA, capital structure) adds a second encryption layer using AWS KMS-managed keys.
Audit & monitoring
✓Activity log. Every meaningful action — document upload, download, role change, deal stage change, exclusivity grant, account deletion request — is logged with the actor, timestamp, and metadata.
✓Per-document access log. Owners can see every download attempt on every document. Useful for SOC 2 evidence and leak investigation.
✓Document watermarking. PDFs downloaded from Arendel are stamped with the viewer's email and a timestamp on every page.
✓Centralized error tracking. Application errors are captured in Sentry with per-org tagging. Errors from one firm never appear in another firm's triage queue.
Availability & backup
✓Encrypted backups. Postgres takes encrypted point-in-time snapshots continuously. Object storage has a separate daily backup job that mirrors all documents to a secondary region.
✓Per-org export. Owners can request a full export of their organization's data at any time. The export contains every deal, document, and audit log entry tied to the org.
✓Status page. Real-time uptime status is available at status.arendel.io.
Compliance & certifications
✓SOC 2 Type II — in progress, target completion Q4 of this year. Audit firm: TBD.
✓GDPR. We honor data access (export) and erasure (deletion) requests from EU data subjects within 30 days. Our DPA template is available on request.
✓HIPAA. Available on the Enterprise tier with a signed Business Associate Agreement (BAA). Required for any deal touching protected health information.
✓Sub-processor list. A current list of vendors who process customer data on our behalf is at /legal/sub-processors.
Operations
✓Change management. Every production deploy goes through a pull-request review, automated typecheck, and a soak period on a separate non-production environment (next.arendel.io → staging.arendel.io → arendel.io).
✓Secret management. Production secrets live in Vercel's encrypted env-var store. No secrets in source code; an isolation-check script catches any drift.
✓Vendor risk management. We review every new vendor for security posture, sub-processor chain, and data residency before granting them access to customer data.
Reporting a vulnerability
If you believe you've found a security vulnerability in Arendel, please email us at security@arendel.io with a description of the issue and reproduction steps. We aim to acknowledge reports within 1 business day and remediate critical issues within 7 days.
We do not currently run a formal bug bounty program but appreciate responsible disclosure and will credit reporters who consent.