Security

This page describes what Maelstrom does today, in plain terms. Where something is planned rather than done, it says so. Questions, or a security issue to report: admin@maelstrom.it.com.

Where we are

• SOC 2: not certified yet. We started a readiness programme on 31 October 2026: the controls are mapped to the Trust Services Criteria, the policies are drafted, and evidence is collected every month. An independent auditor has not been engaged yet; we will say here when an audit has started and when a report is available.
• Penetration test: not yet commissioned by an outside firm. A code-level security review on 31 October 2026 found six issues, the most serious that a firm’s single sign-on settings could make our server request internal addresses; all six are fixed. That review is not a substitute for an independent test, which is on the list.
• Security questionnaires: send yours to admin@maelstrom.it.com and we will answer it accurately, including the parts that are still on the list.

Signing in

• No passwords. You sign in with a six-digit code sent to your email. A code expires in 15 minutes, works once, and five wrong guesses retire it. Codes and sign-in links are stored only as one-way hashes.
• Sessions last up to 30 days and are stored only as one-way hashes. Your account page lists every signed-in device, and you can sign any of them out, or all of them.
• Every sign-in attempt is recorded, successful or not, and you can see recent ones on your account page.
• Single sign-on for firms. A firm can sign in through its identity provider: Okta, Microsoft Entra ID, Google Workspace, or any OpenID Connect provider. We check the provider’s signature on every sign-in, and its issuer, audience, expiry and a one-time value, and the address must be at the firm’s verified domain. With Google, the account must also belong to the firm’s Google Workspace, not merely use a firm address. Once the firm requires it, nobody at that domain can sign in with an emailed code or an old link, so removing someone in your provider removes their way in here. Signing out of sessions that are already open is a separate step on the account page.

Your data

• In transit: the site and the API are served over HTTPS only.
• Secrets we hold for you, such as calendar connection tokens, a firm’s single sign-on client secret and its CRM API keys, are encrypted with AES-256-GCM before they are stored, and are never sent back to the browser.
• Files you share in a deal room are kept in a private storage bucket. Each download link is signed and expires within an hour. A file can require the other side to accept an NDA before it opens, and you can see who opened which file and when.
• Names stay hidden until both sides accept. Before that, an introduction shows what someone is looking for, their company’s verification step and whether they passed an ID check, never who they are.
• ID checks are run by a specialist provider. We never receive or store your document, ID number or date of birth; only the result.
• Payments are handled by Paddle, our merchant of record. We never see or store card details.
• Exports never contain anyone’s email address. CRM files (HubSpot, Salesforce, DealCloud, Affinity) contain only what you can already see on screen.
• Deleting your account takes effect after a short grace period during which you can change your mind, and then it is permanent.

For firms

• Roles. The owner runs the firm, its mandates and its security settings; admins manage the team and answer introductions; members work the deal flow. Invitations only work for the address they were sent to, once, for 14 days.
• Audit log. Sign-ins, team and settings changes, introductions answered, deals moved, notes added, exports, NDAs accepted and files opened, by anyone at the firm. It records actions, not content, can’t be edited, and downloads as CSV. The owner and admins can read it.
• Retention. The owner chooses how long to keep the audit log (one to seven years), team notes on deals, and closed or passed deals; older records are deleted within the hour. Conversations and shared files belong to both sides of a match, so one side’s setting doesn’t delete them.
• Verification. Companies verify their domain with a DNS record and their registration against the public register; people verify with an ID check. Introductions show both.

The application

• Who you are always comes from your session, never from a parameter in a request.
• A strict Content Security Policy on every page: scripts only from our own origin, Paddle’s checkout, or by exact hash; no framing by other sites, and a fixed list of origins the page may talk to.
• Rate limits on sign-in, exports, invitations and everything else that could be abused.
• Every change is reviewed in a pull request and must pass the automated tests, including checks for secrets committed by mistake, before it reaches customers.

Providers we use

The Privacy Policy describes what each kind of provider receives.

Reporting a security issue

Email admin@maelstrom.it.com with “Security” in the subject. Tell us what you found and how to reproduce it; please don’t access other people’s data or disrupt the service while testing. We will reply, keep you informed, and credit you if you would like.