Security

A deal desk has to be able to run both sidesA deal desk has to be able to run both sides

Information barriers, audit trails and isolation are not a feature tier here. They are the condition of a firm being able to use this at all.

What it does

Isolation, proved rather than claimedEvery deal-scoped route is swept in the test suite: a stranger gets a 404 on all of them, and an unshared deal id is indistinguishable from one that never existed.
A restricted dealAn org admin can normally reach any of the firm's deals. On a restricted deal only the owner and explicit members can — which is what running both sides of a transaction requires.
Audit trails you can exportEvery deal and org action is written to an audit log the lead can download as CSV, and it stays reachable even while billing is lapsed.
Authentication the API never writesSessions are verified against JWKS. The API reads identity and never touches the auth tables, so there is one owner of who you are.

On a market this thin the refusals are the product. Anything that fills a gap quietly is the thing you would have to check by hand anyway.

An unguarded routeA sweep over the whole API fails the build if a new endpoint ships without a dependency, unless it is on a short allowlist with a written reason.
Unlimited sign-in attemptsSign-in, sign-up, password reset and two-factor are rate limited both at the edge and inside the application.
Training on your documentsA firm can install its own model provider key. Nothing in a data room is used to improve a model.

Reads from