Security
Last updated: August 20, 2026
Credit applications, bank statements and driver's licences live in here, so this page is specific rather than reassuring. Everything below is on by default, for every customer, at every price — there is no security tier to upgrade to. There is a comparison further down against the software most desks are leaving, so you can see exactly what changes.
One instance per company. Never a shared table.
Most software puts every customer in one database and keeps them apart with a column. That works right up until a query forgets the column. We keep customers apart with the machine instead.
Your own server. Your own database. Your own disk.
Every customer brokerage is provisioned as a separate application instance with its own storage and its own user list. There is no cross-instance query, no central store, and no code path that can read from one customer's data and write to another's, because nothing joins them. Setting up a new customer means standing up a new service, not adding a row.
Being straight about the boundary: isolation is per company, not per user. Inside your instance, your own team shares a workspace by design — the lender notes, the call pool, your playbook. That is what a team board is for. The wall is between your company and every other company.
The controls, stated precisely enough to check.
Real passwords, hashed properly
Eight characters and up, with an uppercase letter and a symbol. Stored as a PBKDF2-HMAC-SHA256 hash with a random per-user salt and 210,000 iterations, and compared in constant time. We cannot read your password and neither can anyone who takes a copy of the file.
A second step, required
A passkey through Face ID, Touch ID or Windows Hello, or a six-digit code from an authenticator app. A passkey's private key never leaves your device. Second-factor sign-in is required on the hosted service, not optional. Trust a device and it skips the code for 30 days, up to 20 devices.
Guess-proof sign-in
Five wrong tries locks the account for 15 minutes, and the lockout doubles each round to a six-hour ceiling. A correct password during a lockout is still refused. Separately, an address making 20 failed attempts in 15 minutes is refused outright. Every attempt is recorded with time, device and address.
Documents sit behind the login
Every file request is checked against a live session before a single byte is served. No public folders, no guessable URLs, no directory listings, and no share link that keeps working after somebody leaves the company.
Encrypted in transit
HTTPS on every request, with HTTP Strict Transport Security set for a year so a browser will not fall back to plain HTTP. Session and device cookies are HttpOnly, SameSite and secure-only. Responses carry no-sniff, frame and referrer protections.
Encrypted at rest, by the platform
Your instance's storage is encrypted at the infrastructure layer by our hosting provider, Render, in the United States. To be precise rather than flattering: that encryption is the platform's, and Dealbrace does not add a second application-level encryption layer on top of it. We would rather tell you that than imply one.
Backed up off the host
Your hosted data is copied off the hosting provider onto separate hardware we control, with daily restore points, retained for 30 days, so a provider-side failure is not a single point of loss. The application also keeps a short rolling history of recent saves so a bad edit can be walked back.
Roles that match the floor
Owners, closers and processors see what the job needs. Access ends the moment a seat is removed, and the record of what that person did stays on the board. One login per person — sharing a seat is a terms violation because it destroys the audit trail.
Nothing watching you
No analytics, no advertising pixel, no session recording, no fingerprinting and no third-party JavaScript in the application. The only outside request a page makes is the one that fetches its typefaces, and that is disclosed in the sub-processor list.
Two boundaries worth knowing by heart.
Better isolation than the software you are leaving.
Salesforce and HubSpot are multi-tenant. Your records sit in one large database alongside every other customer's, kept apart by a column and by the code remembering to check it. Dealbrace gives every company its own server, its own database and its own disk. There is no shared table to query by mistake, because there is no shared table.
| Control | Dealbrace | Typical CRM |
|---|---|---|
| Where your data lives | Your own database | Shared with every other customer |
| Password storage | PBKDF2-HMAC-SHA256 | Same class |
| Second factor | Required, for everyone | Available, usually optional |
| Encryption | In transit and at rest | In transit and at rest |
| Tracking you | None | Analytics, pixels, session capture |
On the controls themselves we are level with them, and on isolation we are ahead. What the large vendors have that we do not is a SOC 2 report — a third party auditing the process, which is not the same thing as the software being more secure. It matters when an enterprise procurement team demands one. If yours does, ask and we will tell you exactly where we are rather than print a badge we have not earned.
Two things are honestly not built yet: single sign-on, and a self-serve export button — export is a request we fulfil by hand, free, within 30 days. Everything else on this page is on by default, for every customer, at every price.
You hear it from us, within 72 hours.
No system is perfectly secure, and anyone who tells you otherwise is selling something. If we discover a security incident affecting your data, we email your account contacts within 72 hours of becoming aware of it with what we know at the time, what is affected and what we are doing about it, and we keep updating you as we learn more rather than waiting until the story is tidy.
Found a hole? Tell us first.
Email security@dealbrace.com with what you found and how to reproduce it. Report it in good faith and give us a reasonable window before disclosing, and we will not treat it as a breach of the terms. We do not run a paid bounty programme, and we will credit you if you want the credit.
This page describes the hosted Dealbrace service as of the date above and
is not legal advice or a warranty. The commitments that bind us are in the
Terms of Service and the
Privacy Policy.
Dealbrace is operated by Phorbes Industries,
Utah, United States ·
support@dealbrace.com