How we protect your information

The database, the documents and the staff sign-in service run on Supabase in Amazon Web Services eu-west-1 (Dublin, Ireland). The application itself — the API and the web pages you use — runs on Railway in its EU West (Amsterdam) region. Storage and processing are therefore both inside the European Economic Area.

Documents live in private storage that is not reachable from the internet. When you open or download a file, the server first checks that you are allowed to see that specific document and then issues a short-lived, signed link for it. Marketing images and broker logos are the only files in public storage.

Two named exceptions leave the EEA, and both are listed under sub-processors below: automated reading of information memoranda by Anthropic (United States), and IP-address geolocation for our own usage analytics (United States).

Every connection is HTTPS; plain HTTP requests are redirected. Both hosts negotiate TLS 1.2 or 1.3 with forward secrecy and send HTTP Strict Transport Security for one year. The web host also sends the standard browser-hardening headers: a Content Security Policy that forbids framing and plug-ins, frame denial, content-type sniffing protection, a referrer policy and a permissions policy.

At rest, the database volumes and object storage are encrypted by the provider (Supabase: AES-256 — provider statement). Sign-in codes, session tokens, staff API tokens and invitation tokens are stored only as keyed or SHA-256 hashes. PINs are checked against keyed hashes (HMAC-SHA256). A seller's PIN also has an encrypted copy (AES-256-GCM, with the key held outside the database) so the broker handling the sale, or our staff, can read the current PIN back to a seller who has lost it; each time a PIN is shown this way it is recorded. No PIN is held in clear in the database.

Brokers and lenders — no passwords. You enter your work email address and we send a 6-digit single-use code to it. The code is valid for 30 minutes, works once, and is refused after five wrong attempts; requests are throttled per address and per network. A successful code gives you an HttpOnly, Secure session cookie that we can revoke at any time. The session ends after 24 hours without use and after 7 days at most, whatever the activity; you can end it yourself from the portal, on this device or on every device at once. When your account is used from a device we have not seen before, we email you to say so. There is nothing to remember and nothing to be phished for.

Practice owners — a personal link and a PIN. Sellers receive a private link for their deal and a 6-digit PIN issued to them by name. The PIN locks for 15 minutes after five wrong attempts, is disabled after three such locks until we re-issue it, and expires 14 days after it was issued. If a seller loses their PIN, their broker or Quantum Medix can read the current one back to them (each reveal is recorded); expired or disabled PINs are re-issued by the broker or Quantum Medix, and the old one stops working at once.

Quantum Medix staff. Staff accounts are created by invitation only, restricted to our own domain, and require an authenticator-app code (TOTP) on top of the password. The multi-factor requirement and the account's active status are checked on every request to the API, not only at sign-in, and accounts lock after five failed attempts. Staff tokens are verified only against our identity provider's current public signing keys; the older shared-secret fallback was removed on 6 October 2026. Public self-registration is blocked at the database.

Access decisions are made on the server, never in your browser. The web application has no direct route to the database; every request goes through our API, which ties each portal link or session to one firm, one named person and one deal, and refuses anything outside that scope. A lender's deal room lists and serves only the documents released into that lender's pack. A seller never sees lender material; a lender never sees our negotiation notes.

Underneath the API, every table in the application database is isolated at the database level, and the database keys that could be reached from a browser hold no privileges on any table at all — a state the database change that applied it verifies before it will complete, and that our staff dashboard re-checks live.

Access is personal. We issue it to named people at a firm, not to a shared mailbox, and the record of every view carries that person's name.

Every portal open, unlock, document view, download, print, comment and link copy is recorded with the time, the person's name, their firm, the deal reference and the device type. Staff who look at a portal "as" a broker or lender do so in read-only mode, and those views are flagged as staff views in the same record. The sign-in pages themselves record requests, failures and lockouts, which is how we notice an attack.

The record never contains a working credential: PINs, sign-in codes and link tokens are stripped before a row is written. A broker, practice owner or lender can ask us for the access report for their deal — who opened and downloaded what, and when — and we produce it on demand as a spreadsheet (CSV) or JSON file; every report we export is itself recorded.

If a portal page fails in your browser — it cannot draw itself, or you had a tab open while we released a new version — your browser sends us a short technical error report so we can fix the fault: the kind of failure, the error message, the first part of the page address with any code or link token removed, your browser type, our software version and your network address. It never includes documents, anything you typed, your PIN or sign-in code. These reports are seen only by our administrators and are deleted automatically after 90 days.

Documents that come from a practice owner are held under the non-disclosure agreement for that deal, and a counterparty's view of them is limited to what that NDA allows. In a lender's deal room, the sections that originate from the seller — accounts, clinician contracts, production reports, payroll, property, the information memorandum — stay locked until that lender has signed the NDA; the file lists and downloads for those sections are refused by the server, not merely hidden, and each refusal is recorded. Every PDF a lender downloads from the deal room is stamped on every page with the downloader's name, firm and the time, so a copy that turns up where it should not says who took it. Letters of intent opened through a review link carry the same kind of watermark.

The database and documents sit on a managed platform with provider-level redundancy, and every application deployment is an immutable build that we can roll back to a previous version in minutes. In addition, Quantum Medix takes its own encrypted database backups on a scheduled job with a 7-daily / 4-weekly rotation. The first full backup and a restore test were completed on 5 October 2026: the archive decrypts byte-for-byte and restores. We are extending this with an encrypted offsite copy.

Two named administrators — the founder and our finance lead — hold staff accounts, and both have verified authenticator-app multi-factor authentication. There are no shared accounts. Accounts that are no longer needed are deactivated, which takes effect on the next request, and the founder reviews the list of active administrators and their MFA status on a live dashboard in the staff application.

• •SSL Labs, 5 October 2026: API host A+; web host A (TLS only — the headers above were added the same evening and a rescan is pending).
• •Mozilla HTTP Observatory, 5 October 2026: API host A+ (135/100). The web host scored D before the security headers were added that evening; a rescan is pending and we will publish the new grade here.
• •Internal audit, 5 October 2026: a read-only review of the code, configuration and database against a vendor-questionnaire checklist. Its "fix first" list has been deployed.
• •Independent penetration test: planned before third-party due-diligence document collection begins. We do not yet hold SOC 2 or ISO 27001 certification and do not claim to. Our controls are aligned to ISO 27001 Annex A; Cyber Essentials is targeted for Q4 2026, Cyber Essentials Plus Q1 2027 and ISO 27001 certification in 2027. Evidence of individual controls is available on request today.

No other third party receives portal data. We do not sell or share information held on the portal, and we do not use it for marketing.

If you believe an account, link or document has been exposed, email privacy@quantummedix.com and we will respond the same working day. If we confirm an incident involving your firm's data we will tell you within 72 hours of confirming it, and notify the Information Commissioner's Office where UK GDPR requires. Our privacy notice at quantummedix.com/privacy explains what we hold and your rights.

The Deal Portal is operated by Quantum Medix Central Ltd, 167–169 Great Portland Street, 5th Floor, London W1W 5PF (company number 17234306). ICO registration number: ZC266920.