Locked down, from the first link to the last download.

Every link and session is a random 256-bit token, and the database stores only a SHA-256 digest of it, so the stored value cannot be presented as someone’s live access token. Staff passwords are hashed with scrypt, a memory-hard function, and checked in constant time. The settings are stored with each hash, so they can be raised later without resetting anyone.

Eight wrong passwords from one address at one account pause that route for 30 minutes. Wider limits catch one address trying many accounts and one account tried from many addresses. Five requests for a password reset or a new request link pause that address for 15 minutes. Both sign-in pages and the reset form give the same answer for known and unknown addresses, so their wording does not reveal who has an account.

Any member of staff can turn on two-factor sign-in: a six-digit code from an authenticator app that cannot be used twice, with eight single-use recovery codes for a lost phone. The team list shows who has it on, and if a colleague loses both phone and codes, an admin can remove it, which is written to the activity trail. The steps are in Two-factor authentication.

Sessions live in an HttpOnly cookie that scripts on the page cannot read. A session lasts 12 hours unless the person chose to stay signed in, in which case it lasts 30 days and extends with use. Where you are signed in lists every device with its network address, and choosing Sign out other devices ends them all. A new password, or removal from the team, ends every session at once.

The owner is the first admin and cannot be removed or demoted. Other staff are an admin, a team member or a viewer, who can read but not change, and access can be All request packs, Selected request packs or Only allocated requests, checked on every request. Someone you ask sees a request only if it is assigned to them, belongs to their party or is shared with the whole room, and a request link never shows your internal notes. In a data room, bidders see the index and the seller’s documents but never each other’s questions or names.

Accepted types are PDF, images, Word, Excel, PowerPoint, CSV, text and ZIP, up to 8 MB a file and 40 MB a reply; anything else is refused before it is stored. For the types with a fixed signature, the first bytes must match the type a file claims to be, so a renamed program is refused rather than stored. Only PDFs and images open in the browser; everything else downloads. Nothing is sent to anyone to be read, indexed or trained on.

Every page is served with a strict Content Security Policy, so it runs only its own code. It refuses to be framed by another site, tells the browser never to guess a file’s type, and keeps its referrer to itself. Every database query is parameterised, and every link in an email is HTTPS: the application refuses to send one that is not.

Every reply, edit, handoff, link created, link withdrawn, reminder sent and archive downloaded is recorded with the person, the time and the request. The trail cannot be edited from the application, and it exports as CSV.

Every night the database and every uploaded file are written into one archive, using SQLite’s online backup so the copy is consistent while the app is in use, and the newest 30 are kept. Each is listed under Backups on the Settings page with its size and file count, so an admin can see that last night’s ran, take one by hand with Back up now, or download any of them. Restore is one documented command, and you never depend on our copy: Download files exports everything for a business or person as a ZIP at any time. The detail is in Backups and restore.

An admin can delete a business or person, or remove a member of the team; any member of staff can delete a request pack, or remove one of the people answering. The requests, replies and files go from the database and the uploads folder at once, and the deletion is recorded with who did it and when. After that, the data is only inside the nightly backups, which are kept for 30 days. Who can delete what is in Deleting data.

Docsroom is made and run by ONAF Limited, a company registered in England and Wales (12589383) and with the Information Commissioner’s Office (ZB643670). You control the data you collect, and we process it for you. Email is sent over HTTPS with the sending key held on the server, and OpenAI is used only if an administrator connects it, when it receives the description typed into the drafting box and never a document. The rest is in our privacy notice.

If you believe you have found a security issue, email security@docsroom.co.uk. We read everything, reply within two working days, and will tell you what we changed.