Deal document security: confidentiality controls, data residency and GDPR for a buyer's tools.

Confidentiality controls in buyer outreach

When a buyer approaches the owner of a technology company directly, the first risk is to the seller: word that the company might be for sale can unsettle staff, customers and competitors. The buyer's controls are simple and mostly a matter of discipline.

• Ask for nothing confidential before an NDA is signed; start from what is public.
• Read the NDA's rules on sharing with advisors, lenders and third-party tools before you upload anything to any of them.
• Keep a log of who on your side has received which document, and when. You may have to return or destroy them later and confirm you did.
• Use one channel for documents, not email attachments spread across inboxes.
• When a deal dies, delete what the NDA requires you to delete, in every tool, and record it.

GDPR and data residency: the questions for any deal platform

Deal documents often contain personal data: employee lists, salaries, customer contacts. Where the GDPR applies, a tool that processes that data for you is a processor, and four points follow from the regulation's text. This is a summary to help you ask the right questions, not legal advice; ask a privacy lawyer which rules apply to your deal.

• A processing contract. Processing on your behalf must be governed by a contract that sets out the subject-matter, duration, nature and purpose of the processing, the type of personal data and the categories of data subjects (Article 28).
• Control over subprocessors. Under the same article a processor shall not engage another processor without your prior specific or general written authorisation, and with general authorisation it must tell you about changes so you can object.
• Transfers outside the EU. A transfer of personal data to a third country must meet the conditions of Chapter V of the regulation (Article 44), for example appropriate safeguards such as standard data protection clauses (Article 46). Data residency in the EU reduces the number of transfers, but ask about the subprocessors too: hosting in one place and processing in another is common.
• Breach notification. A controller must notify the supervisory authority without undue delay and, where feasible, not later than 72 hours after becoming aware of a personal data breach, unless it is unlikely to result in a risk, and the processor must notify the controller without undue delay (Article 33). Your contract with each tool should make that possible.

How Deal OS answers these questions

Deal OS states on its site that each workspace, its documents and its database are hosted in the European Union (France), that documents are encrypted at rest and each workspace is isolated from others, that documents are never used for training, that you can export or delete your data, and that AI and payment subprocessors are governed by its data processing agreement under EU Standard Contractual Clauses. A mutual NDA can be signed in the workspace before you upload anything. Read the information security page, the GDPR summary and the data processing agreement yourself rather than relying on this paragraph.

Worked example from the sample brief

What happens to the documents once they are uploaded: a reviewer gets a brief in which every finding cites its page. From the sample brief (a synthetic deal):

1. A claim contradicted by the document's own table. The CIM says on page 8 that no customer is more than 15% of revenue. Page 9 lists the top account (Northgate Property Group) at $1,366,000 against $6.21M of revenue, which the brief computes as 22.0%. The brief shows both passages word for word, each with its page, and marks the page 8 statement as false on the CIM's own numbers.
2. A headline figure that two documents state differently. Trailing twelve month revenue is $6.21M on page 6 of the CIM and $5.95M as gross receipts on the tax return. The brief shows the $260K gap side by side and says to reconcile it before applying any multiple.
3. A definition that changes what a number means. Page 7 says about 78% of revenue is recurring. Page 22 defines recurring as all revenue from accounts with an active inspection agreement, including repair and call-out work. The brief flags the two passages as inconsistent and asks for a revenue cut that separates fixed inspection billings from variable work.
4. Add-backs sorted by whether they are likely to survive. The seller presents adjusted EBITDA of $1.42M. The brief itemizes the add-backs and rates each one; $90K of them are rated questionable or unlikely, which gives $1.33M that holds up on the documents. The arithmetic is computed, and the ratings are a first judgment for a human to confirm.
5. A statement the documents do not support, thrown out. While drafting, the model proposed that the company has no outstanding litigation. No passage says so, so the verifier discarded it and the brief lists it in a verification log, with a request for a 10-year litigation history instead.

The example is Sentinel Fire & Safety, Inc., a synthetic company built to show the product. Nothing in it describes a real business, and the same output shape applies to a real data room. See the whole thing at /sample-brief.