Closedata

Security and Data Protection

Last updated: 17 August 2026

Closedata is used by private equity funds, M&A boutiques and corporate development teams working on confidential mandates. This page describes how the platform is hosted, how data is protected and what commitments we make about the information you bring into Closedata.

1. Where data is hosted

The Closedata platform, its databases and its backups are hosted in data centres located in the European Union, operated by infrastructure providers that maintain their own recognised security certifications. Client workspaces, saved theses, pipeline records and uploaded documents do not leave the EU in the ordinary course of operation.

Where a subprocessor is located outside the European Economic Area, the transfer is covered by the safeguards described in our Privacy Policy and GDPR pages, in particular adequacy decisions or standard contractual clauses.

2. Encryption

• All traffic between your browser and Closedata is encrypted with TLS 1.2 or above. HTTP requests are redirected to HTTPS.
• Data at rest, including the primary database, file storage and backups, is encrypted using AES-256 or an equivalent standard provided by the hosting platform.
• Secrets, API keys and credentials are held in a managed secret store and are never committed to source code.
• Passwords are never stored in plain text; authentication uses salted one-way hashing.

3. Access control and authentication

• Access to client workspaces is restricted to named users invited by the client, with role-based permissions inside the workspace.
• Multi-factor authentication is available on all accounts and can be enforced at workspace level.
• Single sign-on (SAML or OIDC) is available for enterprise clients so that access follows your own identity provider, including immediate revocation on offboarding.
• Internally, access to production systems follows least privilege, is limited to a small number of engineers, requires MFA and is reviewed periodically. Support staff do not access client workspace content unless the client requests it.

4. Audit logs and monitoring

Authentication events, permission changes, searches, exports and administrative actions are recorded with user, timestamp and origin. Enterprise clients can request an export of the audit trail for their own workspace. Infrastructure and application logs are monitored for anomalous behaviour, and alerts are routed to the engineering team.

5. Backups and continuity

• The production database is backed up automatically on a daily basis, with point-in-time recovery available over a rolling window.
• Backups are encrypted and stored in the European Union, separately from the primary environment.
• Restore procedures are tested periodically so that recovery is a rehearsed operation and not an assumption.

6. Data retention

Client workspace content, including theses, notes, pipeline records and uploaded documents, is retained for the duration of the contract. On termination, the client may request an export, and the data is deleted from production systems within 30 days and purged from backups within the backup rotation cycle.

Company and market information sourced from official registries and licensed providers is retained as part of the underlying database and is governed by the legal bases set out in the Privacy Policy. Personal data collected through the website, such as demo requests, is retained only for as long as necessary for the purpose it was collected for.

7. Artificial intelligence and your data

Closedata does not rely on public language models. The models behind the conversational layer, the scoring and the signal detection are our own, trained and operated by us in our own environment, offline and isolated from any external model provider. Our commitments are explicit:

• No public or third-party LLM is used to process your data. Your theses, searches, notes and documents never leave our infrastructure and are never sent to an external model provider.
• Client data is never used to train public or shared foundation models, because no such model is part of our pipeline.
• Your data is never shared with third parties. Your activity is not exposed to other clients, and improvements to our own models are built on aggregated and de-identified signals, never on another client's confidential mandate.
• Outputs are traceable: financial figures reference the underlying filing and date, so that conclusions can be verified rather than trusted blindly.

8. Development and change management

• Changes are peer reviewed and pass automated checks before reaching production.
• Development and production environments are separated. Production data is not copied into development environments.
• Dependencies are monitored for known vulnerabilities and updated as part of routine maintenance.

9. Incident response

We maintain an internal procedure for detecting, containing and investigating security incidents. Where an incident affects personal data, Closedata notifies the competent supervisory authority within 72 hours where the GDPR requires it, and informs affected clients without undue delay, with the facts known at the time and the mitigation under way.

10. Vendor due diligence and reporting

We are used to security questionnaires and vendor onboarding reviews. For a subprocessor list, a data processing agreement, our security questionnaire responses, or to report a suspected vulnerability, contact legal@closedata.co. Vulnerability reports are acknowledged and investigated, and we will not pursue action against good-faith research.