Security Statement

TrueValue Technologies Ltd provides a deal workspace for M&A advisers and business buyers. Deal information can be commercially sensitive even when it contains no personal data. We treat protection of customer documents, permissions, communications and transaction information as part of our service responsibilities.

We commit to appropriate technical and organisational measures proportionate to the information and risks involved. Our DPA sets out the contractual minimum measures for Customer Personal Data, and our Terms of Service protect confidential Customer Data more broadly. This statement summarises the approach; it does not replace those obligations or create an absolute guarantee that an incident will never occur.

We limit access according to roles and operational need. Security must be enforced in the application, database and file-storage layers, including server-side checks of relevant workspace and document permissions. Customer administrators control the users and recipients they authorise within the available features.

Administrative access must be attributable to authorised people, use appropriate stronger authentication and be removed when no longer needed. Customer-facing security options are described in the application. A feature's appearance in marketing must not be interpreted as confirmation that it is enabled for every account or integration.

Sharing a link or authorising an external recipient is a disclosure decision. Revoking access can stop future access through TrueValue but cannot reliably recall a file already downloaded, an email delivered or a copy made outside the service.

We protect transmission with supported industry-standard transport encryption and apply storage encryption and key controls appropriate to the deployed architecture and agreed DPA measures. We restrict access to secrets, service credentials and integration tokens and avoid including them in ordinary logs or public code.

Encryption in transit or at rest is not the same as end-to-end encryption, customer-exclusive key ownership or prevention of all authorised service access. We do not make those additional claims unless they are specifically supported and agreed.

Security-relevant changes should be reviewed and tested before deployment, with risk-appropriate checks of authentication, permissions, data isolation and external actions. Dependencies and vulnerabilities are assessed and prioritised according to risk. Production data is minimised in development and testing environments.

Independent penetration tests, certifications and audit reports are described only where completed and applicable to the relevant scope. A hosting provider's assurance does not certify every TrueValue feature. Ask security@truevalue.business about evidence available for your procurement assessment; disclosure may be subject to appropriate confidentiality arrangements.

We keep proportionate security and administrative event records to support investigation and accountability. Logs must be protected, access limited and retention aligned with our retention schedule. We avoid placing unnecessary confidential document contents or credentials in diagnostic systems.

Automated alerts are not the same as a continuously staffed security operations centre. Any specific staffed coverage or response commitment is stated only in an expressly agreed service arrangement. The breach-notification obligations in the DPA and Incident Response and Breach Notification Policy remain applicable regardless of ordinary support hours.

AI processing must follow customer instructions, the DPA and the supplier arrangements identified in the Subprocessor Register. Confidential Customer Data is not used to train general-purpose AI models. This commitment must apply through relevant intermediaries and model providers, not just to TrueValue's own development activity.

Customer-connected services should receive only the permissions needed for the chosen task. External communications and disclosures require the approval specified in the AI, Valuation and Agent Terms. An approval record is a record of authorisation, not proof that every commercial statement in the approved content is correct.

We maintain protected recovery arrangements appropriate to the service and the agreed DPA. Database recovery and uploaded-file recovery must be considered separately. Backup scope, retention and restoration procedures are documented and tested at a risk-appropriate frequency.

Unless expressly agreed, we do not promise a particular restoration time, maximum data-loss window, geographic replication configuration or continuous availability. Customers should retain independent copies of records they are legally or commercially required to preserve. This does not waive our own agreed backup or restoration responsibilities.

After termination or a verified deletion instruction, active and residual backup information is handled under the Data Retention, Export and Deletion Policy. Backup retention is not permission to continue ordinary use of deleted customer content.

We assess relevant suppliers, document their processing obligations and restrict access to the information needed for their functions. The Subprocessor Register describes applicable processing locations and transfers. Local hosting alone does not establish that every processing operation stays in the UK.

People with authorised access are subject to appropriate confidentiality obligations and role-relevant security responsibilities. Suspected incidents are escalated and assessed under our incident process. We notify affected customers in accordance with the DPA and Incident Response and Breach Notification Policy, including the agreed initial notification period.

Use strong unique credentials and available additional authentication, promptly remove leavers, review workspace and sharing permissions, keep integration access limited, and verify recipients and document versions before disclosure or signing. Report suspicious activity promptly and preserve relevant evidence without unnecessarily sharing sensitive files.

Do not assume a “verified” badge, a data-room control or an electronic signature replaces counterparty checks, professional advice or your own legal obligations. Security is supported by both service controls and appropriate customer configuration; our contractual responsibilities remain our own.

Report suspected compromise or a vulnerability to security@truevalue.business. Include a concise description, affected feature, approximate time and safe reproduction information. Do not include passwords, full payment details or unrelated customer records. Request a secure evidence-transfer method where needed.

Do not probe other customers' data, run denial-of-service tests or exploit a vulnerability beyond what is necessary to identify it. Coordinated testing requires appropriate authorisation. Receipt of a report does not promise a bounty or authorise further access.

TrueValue Technologies Ltd, company number 17462580. Registered office: 66 Paul Street, London, England, United Kingdom, EC2A 4NA.