Security at DealWise AI
You upload leases and financial statements that are not only yours. This page says how they are stored, how they are delivered, and what the artificial intelligence provider may and may not do with them.
A lease is a contract about people who never agreed to anything with DealWise, a tenant, a guarantor, a seller. That is the reason this page exists in the detail it does, and the reason it names its own gaps rather than waiting for someone to find them.
The Data Processing Addendum treats what follows as its description of technical and organisational measures. Changing one of these sentences therefore means changing a contract, which is the discipline that keeps the page honest.
What is in place today
Each of these is a property of how the product is built, not a policy someone is asked to follow.
Documents live in a private bucket
Uploaded files are stored privately, and nothing in the product mints a public or a shareable download link: every download runs through one authenticated route, checked against your account. Uploads are the one exception, and deliberately. Your browser is issued a short-lived, single-purpose ticket to write one file directly to storage, so the bytes never pass through the application. It grants no read access and expires.
Bytes come back out through one door
A document is delivered by a single authenticated route, which streams it from storage only after the database has confirmed the signed-in account owns that document. There is no second path.
Accounts are isolated by the database
Isolation is Postgres row-level security running under the signed-in user's id, not a check written in application code. Another account's deal is not merely hidden from you. It is invisible to the query, and the route answers 404.
Every delivery is recorded
Each time a document's bytes are handed over, that is written to an activity log against the account that received them. A failed request is not recorded as a read, because nothing was disclosed.
Error reports carry no credentials
Reports keep an allowlist of technical headers and never cookies. Session tokens, signed URLs and email addresses are replaced with placeholders before an event leaves the service.
Encrypted in transit, encrypted at rest
The site is HTTPS throughout, and documents sit in managed object storage that encrypts them at rest. In production the application refuses to start at all rather than fall back to storing customer documents on an unencrypted local disk.
What the AI provider receives
Described by function here and on the sub-processor list, and named in writing to any customer who asks.
Reading a lease, an operating statement, an offering memorandum or a comparable-sale sheet sends the text of that document to the provider, and for a scanned file the file itself. Running a deal analysis or a listing price opinion sends the figures derived from your rent roll and deal inputs, which include tenant and guarantor names, any credit rating or internal grade you have recorded against them, and lease dates. Running a tenant risk analysis sends that tenant’s details on their own, built from your records rather than from any document. So the transfer is not limited to documents, and it is not limited to numbers: named third parties are in it.
Each of those transfers follows something you did. A document is read because you uploaded it: the reading starts straight away on the deal page if you have it open, and a scheduled job reads anything left unread, so it finishes whether or not you stay. A deal analysis, a listing price opinion or a tenant risk analysis runs only when you ask for one. Nothing is sent for a feature you did not use.
The commercial agreement behind that provider does not permit your content to be used to train its models. DealWise does not train models on your content either, and does not sell it.
What DealWise cannot do is guarantee the provider's own infrastructure. It is a sub-processor under clause 7 of the Data Processing Addendum, bound to terms no less protective than the ones DealWise gives you, and DealWise remains answerable to you for it.
What this page does not claim
A security page that overstates is the one that causes the problem.
Everything above is a control that exists in the product today. Nothing on this page describes a capability DealWise is planning, and nothing here should be read as a certification.
If you are running a vendor review, the Data Processing Addendum is written for you: it states the formal position on audits and reports, including which attestations DealWise can and cannot provide. DealWise will also complete a written security questionnaire. Write to support@dealwiseai.com and a person will answer it.
Reporting a problem
If you think you have found a vulnerability, write to support@dealwiseai.com with enough detail to reproduce it. A person reads that address, and you will get a reply saying what was done about your report. The same address is published for tools that look for it, at /.well-known/security.txt.
There is no bug bounty and DealWise cannot pay for reports. Please do not test against another customer's account or against data that is not yours.
See also the Data Processing Addendum, the Sub-processors list, and the Privacy Policy.