Security at DealWise AI
You upload leases and financial statements that are not only yours. This page says how they are stored and delivered, what the artificial intelligence provider may and may not do with them, and — just as plainly — what DealWise does not have.
A lease is a contract about people who never agreed to anything with DealWise — a tenant, a guarantor, a seller. That is the reason this page exists in the detail it does, and the reason it names its own gaps rather than waiting for someone to find them.
The Data Processing Addendum treats what follows as its description of technical and organisational measures. Changing one of these sentences therefore means changing a contract, which is the discipline that keeps the page honest.
What is in place today
Each of these is a property of how the product is built, not a policy someone is asked to follow.
Documents live in a private bucket
Uploaded files are stored privately, and nothing in the product mints a public or a shareable download link: every download runs through one authenticated route, checked against your account. Uploads are the one exception, and deliberately — your browser is issued a short-lived, single-purpose ticket to write one file directly to storage, so the bytes never pass through the application. It grants no read access and expires.
Bytes come back out through one door
A document is delivered by a single authenticated route, which streams it from storage only after the database has confirmed the signed-in account owns that document. There is no second path.
Accounts are isolated by the database
Isolation is Postgres row-level security running under the signed-in user's id, not a check written in application code. Another account's deal is not merely hidden from you — it is invisible to the query, and the route answers 404.
Every delivery is recorded
Each time a document's bytes are handed over, that is written to an activity log against the account that received them. A failed request is not recorded as a read, because nothing was disclosed.
Error reports carry no credentials
Reports keep an allowlist of technical headers and never cookies. Session tokens, signed URLs and email addresses are replaced with placeholders before an event leaves the service.
Encrypted in transit, encrypted at rest
The site is HTTPS throughout, and documents sit in managed object storage that encrypts them at rest. In production the application refuses to start at all rather than fall back to storing customer documents on an unencrypted local disk.
What the AI provider receives
Described by function here and on the sub-processor list, and named in writing to any customer who asks.
Reading a lease, an operating statement, an offering memorandum or a comparable-sale sheet sends the text of that document to the provider, and for a scanned file the file itself. Running a deal analysis or a listing price opinion sends the figures derived from your rent roll and deal inputs — which include tenant and guarantor names, any credit rating or internal grade you have recorded against them, and lease dates. Running a tenant risk analysis sends that tenant’s details on their own, built from your records rather than from any document. So the transfer is not limited to documents, and it is not limited to numbers: named third parties are in it.
Each of those transfers happens because you started that action on the deal page. Nothing reads your documents on a schedule, and nothing is sent for a feature you did not ask for.
The commercial agreement behind that provider does not permit your content to be used to train its models. DealWise does not train models on your content either, and does not sell it.
What DealWise cannot do is guarantee the provider's own infrastructure. It is a sub-processor under clause 7 of the Data Processing Addendum, bound to terms no less protective than the ones DealWise gives you, and DealWise remains answerable to you for it.
What DealWise does not have
A security page that overstates is the one that causes the problem. These are the gaps, in the same plain words as the controls above.
No multi-factor authentication
Sign-in is by email and password, or by a one-time link sent to your address. DealWise adds no second factor of its own, so an account with a password is protected by that password alone.
No SOC 2 report and no ISO 27001 certificate
There is nothing to send you and nothing in progress. If your vendor review requires one, DealWise does not meet that bar today, and it is better that you know it now than at renewal.
No third-party penetration test
The application has not been tested by an outside firm, and there is no report to share.
No audit log you can read
Document deliveries are recorded, but there is no way for you to read that record yourself — you would have to ask. Administrative access to the database and to file storage is not reported to you at all.
No uptime commitment
The Terms provide the Platform on an “as is” and “as available” basis. There is no service level agreement, no availability target and no credit for downtime.
No self-service account closure
You can delete a deal at any time and its stored files go with it. Closing the whole account is done by email, and DealWise commits to thirty days rather than to a button.
No search inside stored documents
The Platform cannot search the contents of what you have uploaded. Finding every place one person is named across a large document set is a manual exercise, which matters most when someone exercises a data subject right.
A small team, and no separate security function
DealWise is run by a very small team. Access to production is limited to the people who run the service, but there is no dedicated security role and no on-call rotation behind that.
Reporting a problem
If you think you have found a vulnerability, write to support@dealwiseai.com with enough detail to reproduce it. A person reads that address, and you will get a reply saying what was done about your report.
There is no bug bounty and DealWise cannot pay for reports. Please do not test against another customer's account or against data that is not yours.
See also the Data Processing Addendum, the Sub-processors list, and the Privacy Policy.