Server-side keys
LLM provider credentials are loaded from environment variables and never exposed to browsers.
Security and privacy.
The finance domain demands restraint with confidential data. DealDesk keeps provider keys server-side and treats uploaded documents as ephemeral, parsed for context then dropped. Below is exactly what we keep, what we never keep, and how each control is implemented.
Ephemeral documents
Uploaded files are parsed in memory and never written to disk. Only text you explicitly save — document sets and citation excerpts — is retained, scoped to your workspace.
Workspace isolation
Every record carries your workspace ID and every query is scoped to it at the data layer — roles, deliverables, documents, chats, and billing never cross tenants.
Encrypted BYOK
Bring-your-own LLM keys are encrypted at rest with AES-256-GCM and are never returned to the browser after you save them.
Metadata-only logs
Structured logging redacts secrets, prompts, response bodies, and document content. Usage records store token counts, not text.
No training on your data
Model providers are called through their commercial APIs, which do not use API traffic to train models. Your deal work stays your deal work.
Enterprise SSO
Enterprise workspaces can enforce sign-in through their own identity provider via OIDC or SAML — Okta, Azure AD, Google Workspace.
AI analysis disclaimer
Generated finance outputs are marked as AI-assisted analysis and require source verification.
How each control is implemented.
Authentication
Server-managed sessions with email + password and email verification, Google sign-in, and enterprise SSO (OIDC / SAML). Sessions are httpOnly cookies — no tokens in browser storage.
Tenant isolation
Hard tenant scoping: every table carries a workspace ID and every query filters on it. Admin access is role-gated per workspace, with a separate app-admin tier for platform operations.
LLM key security
Managed provider keys live only in server environment variables. Bring-your-own keys are encrypted at rest with AES-256-GCM, decrypted server-side per request, and never sent back to the client.
Document handling
Files (PDF, Excel, Word, CSV — up to 40 MB) are parsed server-side in memory and discarded after the run. Raw files are never written to disk. Saved document sets keep extracted text only, inside your workspace.
Transport security
TLS on every connection; HTTPS is enforced in production. Provider calls go server-to-server.
Audit trail
Billing changes, membership and role changes, and catalog edits are recorded in a per-workspace audit log, viewable in the admin console.
Data deletion
Chats, workflow runs, and document sets can be deleted in-app at any time. On cancellation, workspace data is removed on request — raw deal documents were never stored, so there is nothing else to delete.
Compliance posture
The server never persists raw deal documents, which keeps the audit surface deliberately small. SOC 2 Type II certification is in progress.
Common questions from security reviews.
Does DealDesk store my deal documents?
Raw files are never stored. Documents are parsed in server memory, the extracted text feeds the analysis, and the file is discarded. If you save a document set for reuse, only the extracted text is kept — scoped to your workspace and deletable at any time.
Which LLM providers are supported?
Anthropic (Claude), OpenAI, Google Gemini, Mistral, Groq, DeepSeek, and OpenRouter — through DealDesk's managed keys or your own. Enterprise workspaces can point at a private endpoint (Azure OpenAI, AWS Bedrock, self-hosted).
Can I bring my own LLM key?
Yes. BYOK keys are detected by prefix, encrypted at rest with AES-256-GCM, used server-side only, and never returned to the browser. Remove a key and it is gone — we keep only a display hint like sk-…1234.
Who can see my workspace?
Only invited members. Workspace roles (owner, manager, member) gate admin functions, and project-level permissions narrow access further. Platform administrators see billing metadata — never your documents or conversations.
What happens to my data if I cancel?
Your subscription runs to the end of the billing period. Workspace data — chats, runs, saved document sets, configuration — is deleted on request. Raw deal documents were never stored.