Security
Last updated: August 20, 2026
Credit applications, bank statements and driver's licences live in here, so this page is specific rather than reassuring. Everything below is on by default, for every customer, at every price — there is no security tier to upgrade to. At the bottom there is a list of the things we have not built, because a security page that only lists strengths is not a security page.
One instance per company. Never a shared table.
Most software puts every customer in one database and keeps them apart with a column. That works right up until a query forgets the column. We keep customers apart with the machine instead.
Your own server. Your own database. Your own disk.
Every customer brokerage is provisioned as a separate application instance with its own storage and its own user list. There is no cross-instance query, no central store, and no code path that can read from one customer's data and write to another's, because nothing joins them. Setting up a new customer means standing up a new service, not adding a row.
Being straight about the boundary: isolation is per company, not per user. Inside your instance, your own team shares a workspace by design — the lender notes, the call pool, your playbook. That is what a team board is for. The wall is between your company and every other company.
The controls, stated precisely enough to check.
Real passwords, hashed properly
Eight characters and up, with an uppercase letter and a symbol. Stored as a PBKDF2-HMAC-SHA256 hash with a random per-user salt and 210,000 iterations, and compared in constant time. We cannot read your password and neither can anyone who takes a copy of the file.
A second step, required
A passkey through Face ID, Touch ID or Windows Hello, or a six-digit code from an authenticator app. A passkey's private key never leaves your device. Second-factor sign-in is required on the hosted service, not optional. Trust a device and it skips the code for 30 days, up to 20 devices.
Guess-proof sign-in
Five wrong tries locks the account for 15 minutes, and the lockout doubles each round to a six-hour ceiling. A correct password during a lockout is still refused. Separately, an address making 20 failed attempts in 15 minutes is refused outright. Every attempt is recorded with time, device and address.
Documents sit behind the login
Every file request is checked against a live session before a single byte is served. No public folders, no guessable URLs, no directory listings, and no share link that keeps working after somebody leaves the company.
Encrypted in transit
HTTPS on every request, with HTTP Strict Transport Security set for a year so a browser will not fall back to plain HTTP. Session and device cookies are HttpOnly, SameSite and secure-only. Responses carry no-sniff, frame and referrer protections.
Encrypted at rest, by the platform
Your instance's storage is encrypted at the infrastructure layer by our hosting provider, Render, in the United States. To be precise rather than flattering: that encryption is the platform's, and Dealbrace does not add a second application-level encryption layer on top of it. We would rather tell you that than imply one.
Backed up off the host
Your hosted data is copied off the hosting provider onto separate hardware we control, with 30 days of daily restore points, so a provider-side failure is not a single point of loss. The application also keeps a short rolling history of recent saves so a bad edit can be walked back.
Roles that match the floor
Owners, closers and processors see what the job needs. Access ends the moment a seat is removed, and the record of what that person did stays on the board. One login per person — sharing a seat is a terms violation because it destroys the audit trail.
Nothing watching you
No analytics, no advertising pixel, no session recording, no fingerprinting and no third-party JavaScript in the application. The only outside request a page makes is the one that fetches its typefaces, and that is disclosed in the sub-processor list.
Two boundaries worth knowing by heart.
What we don't claim.
Certifications and controls we do not have. If a competitor's page is silent on these, that is not the same as having them. Ask us directly about any of it and you will get a straight answer.
We keep this list current. If something moves from this column to the one above it, the date at the top of the page changes with it.
You hear it from us, within 72 hours.
No system is perfectly secure, and anyone who tells you otherwise is selling something. If we discover a security incident affecting your data, we email your account contacts within 72 hours of becoming aware of it with what we know at the time, what is affected and what we are doing about it, and we keep updating you as we learn more rather than waiting until the story is tidy.
Found a hole? Tell us first.
Email security@dealbrace.com with what you found and how to reproduce it. Report it in good faith and give us a reasonable window before disclosing, and we will not treat it as a breach of the terms. We do not run a paid bounty programme, and we will credit you if you want the credit.
This page describes the hosted Dealbrace service as of the date above and
is not legal advice or a warranty. The commitments that bind us are in the
Terms of Service and the
Privacy Policy.
Dealbrace is operated by Phorbes Industries,
Utah, United States ·
support@dealbrace.com