How we keep your files safe

Tax returns and bank statements are about as sensitive as documents get. Here, in plain English, is where yours live, who can see them, how we record every look, and when we delete them.

Where your files are stored

Encrypted with our own key before it's stored. Every file is encrypted (AES-256) on our server before it goes to storage, with a key that is kept apart from the storage and the database. Someone who got hold of the storage itself would get unreadable data. Our storage provider adds its own encryption on top.
In private cloud storage, with a major US provider (DigitalOcean Spaces, in San Francisco), under random file names. Nothing is in a public folder, and no file has a web address of its own.
Behind a permission check on every download. We confirm who you are and whether you're allowed to see the file, then decrypt it and send it to you directly. There's no link to pass around.

Who can see what

Your private financial files (tax returns, statements) are visible only to you and the deal team members you add. Buyers never see them unless you choose to share a file in your data room.
Your data room is visible only to your team and to buyers you approve, after they accept our confidentiality terms. PDFs buyers download are stamped on every page with their name and the date, so a leaked copy can be traced.
A record of who opened what. Every time anyone opens, adds or deletes one of your files, it's recorded: your deal team, buyers, our automatic reading, and DealSwirl staff, who appear as "DealSwirl support". You can see the full list on your deal's File access log, and nobody can edit or remove entries through DealSwirl. Because files can only be opened through our download pages, the log is complete.
You stay in control. You decide what goes in the data room, and you can delete anything from it at any time. Deleting a file removes it from your account right away, and stored older copies are cleared out of our storage within about 30 days.

When your files are deleted

After your deal ends. When you mark a deal Closed or Withdrawn, the data room closes to buyers at once, and we remind approved buyers that the confidentiality terms ask them to delete what they downloaded. 90 days later we delete the deal's files: your private financial files and everything in the data room. You'll get reminders 30 and 7 days before, with a button to download everything first, or you can delete them sooner yourself.
If a deal is abandoned. If nobody on the deal team signs in for a year, we email a warning and delete the files 30 days later unless someone signs in.
What stays. The numbers read from your files (yearly figures, add-backs, reports) stay in your account until you delete the deal or close your account. Encrypted backups age out within 30 days.
What we can't reach. Copies buyers already downloaded are on their own computers. They're watermarked with the buyer's name and covered by the confidentiality terms, but we can't delete them for you.

Tax returns in particular

We don't ask for Social Security numbers, and you can leave them out. When you share a PDF in your data room, you can share a redacted copy that permanently blacks out Social Security numbers, tax ID numbers and bank account numbers, with no hidden text underneath.
If you ask us to read a return automatically, we remove those same numbers first and send only the cleaned text to our AI provider. The original file never leaves our storage. Details are in our privacy policy.

Protecting your account

Sign in with a password, and add a second step with an authenticator app, a passkey (fingerprint or face on your phone or laptop) or recovery codes. You can turn these on in Settings.
Our own staff accounts, which can see every deal, are required to use two-factor sign-in.

How our systems are protected

Everything travels over encrypted HTTPS connections.
Our server accepts only web traffic and key-based administrator logins (no passwords), blocks repeated abuse automatically, and installs security updates automatically.
We back up our database every night, encrypted, and keep those backups for 14 days.

What we can't promise

No system is perfectly secure, and we won't claim ours is. We're a small team that keeps the design simple, limits who can see what, and keeps sensitive data to a minimum. If you see something that looks wrong, or you have a security question before uploading, please contact us.