Solution 03 · Elevaition Data Room

Your deal documents.
Secure, audited, answerable.

Stakeholders ask questions in plain English and get answers with citations. You see every question they asked. A role-based data room where confidentiality is enforced on the server, not just hidden in the UI, and every action is written to a trail nobody, including admins, can forge.

Row-Level Security on every table · NDA and rate limits enforced server-side · deployed under your brand and domain

Elevaition Data Room · Documents
Financial ModelNORTHGATE-C
Series C Financial Model v4.xlsxValidated↓ Download
Cap Table (unsigned).pdfIncompleteUnsigned
Term Sheet draft.docxNew👁 View-only
Management Accounts Q2.xlsxValidatedStale date↓ Download
100%
of actions audit-trailed, forge-proof
0
passwords required, magic-link sign-in
2FA
optional or admin-enforced for everyone
AI
reads every upload for diligence red flags

Built for high stakes

Security that proves itself

Investors and advisors see exactly what you allow, nothing more. Every guard lives in the database and the API, not only in a dismissible modal.

01 · Sign-in

Auth & Two-Factor

Magic-link or password sign-in via Supabase Auth. Optional TOTP two-factor, with an admin toggle to hard-enforce it for every user once the room holds signed term sheets.

481206
02 · The record

Forge-Proof Audit Trail

Every login, view, download, search and permission change is written by the database itself. A trigger overwrites who the actor is from the session, so no one can forge an entry, not even an admin.

VIEWFinancial Model v4
DOWNLOADRoom Sheet.pdf
PERMISSIONCap Table access granted
03 · Confidentiality

Server-Side NDA Enforcement

Accepting the confidentiality terms is checked again on every data-egress call, chat, search, download, not just gated once in the UI. Script the API directly and you still hit the same wall.

04 · Leak traceability

Watermarked on Every View

Every PDF preview and download is stamped server-side with a faint confidentiality mark plus the viewer's identity and timestamp baked into the file itself, so a copy still carries who saw it.

CONFIDENTIALCONFIDENTIAL · [email protected] · 2026-06-22T09:41:03Z
05 · Granular control

View-Only, Expiry, and Lifecycle

Mark a document view-only and downloads are refused server-side. Give it an expiry date, soft-delete it, or supersede it with a new version, and the audit history survives every change.

👁 View-onlyExpires 30 SepSupersedes v3
06 · Phased access

Staged Disclosure & Access Requests

Restrict a sensitive folder to named users only. Everyone else sees it is locked and can request access, with a reason, for an admin to approve or decline.

🔒LitigationRequest access
Pending: R. Osei · "Need for legal review"
07 · Diligence AI

AI Red-Flag Detection

Every upload is scanned on ingest for stale dates, unsigned signature blocks, missing expiry and placeholder text, and surfaced in a per-project diligence brief, most-flagged first.

Cap Table (unsigned).pdfUnsigned
Management Accounts Q2.xlsxStale date
08 · Ask, don't search

RAG Chat with Citations

Ask a plain-English question and get an answer grounded only in the room's own documents, with every claim traceable to a source.

"What's the current monthly burn?"
£184k/month as at May, trending down from £211k in Q1.
[Management Accounts Q2.xlsx]
09 · Closing the deal

Deal-Close and Audit Evidence Pack

One click freezes uploads and marks the room closed, reads stay open so nothing disappears. A second click builds a ZIP evidence pack: the full audit log, the document index, and every confidentiality acceptance, as the deal's permanent closing binder.

NORTHGATE-C-evidence-pack-2026-06-22.zip
  • audit_log.csv
  • document_index.csv
  • nda_acceptances.csv

Signatures, settled

E-signature, inside the room

Send a PDF for signature and get a court-defensible signed copy back, without the document ever leaving the data room's audit trail.

01 · The ceremony

A Signing Ceremony That Proves Identity

Each signer receives a unique, single-use link and proves control of their email with a one-time passcode before the document opens. They draw their signature and give explicit consent, so every signed copy rests on a verified signer, not a forwarded attachment.

Single-use linkEmail passcodeDrawn signatureExplicit consent
02 · The evidence

Legal Backing Baked Into the File

The signed PDF carries an E-SIGN Act / UETA consent statement and a full audit page: signer name and email, timestamp, IP address, and the document's SHA-256 fingerprint, so any later tampering is evident from the file itself.

Term Sheet (signed).pdf · audit page
  • Signer: [email protected]
  • Signed: 2026-06-22T14:07:51Z · IP 81.2.69.142
  • SHA-256: 9f86d081884c7d65…
03 · Two paths

CRM or Self-Serve

Linked to the Elevaition CRM, the data room hands the document over and the CRM runs the signing ceremony. Standing alone, the data room runs the whole flow itself. Either way, nothing extra to buy or bolt on.

04 · Cryptographic seal

Optional PDF Signature

Configure a signing certificate and each signed PDF can also carry an embedded cryptographic signature (PAdES / PKCS#7), verifiable in any standards-compliant PDF reader.

05 · Back in the room

Returned as a New Version

The signed copy is stored back in the room as a new version that supersedes the original, with the audit history intact. PDFs only, by design: what was signed is exactly what is kept.

Supersedes v1 (unsigned)✓ Signed copy stored

How a room lives

From first invite to closing binder

Six stages, the same lifecycle every deal actually goes through.

01

Deploy

One Vercel project, one Supabase project, your brand and domain.

02

Invite

Bulk-invite stakeholders with per-project read, upload and delete permissions.

03

Gate

New sign-ins hit the confidentiality gate, then MFA enrolment if it's required.

04

Enrich

Every upload is chunked, embedded, summarised and scanned for red flags.

05

Disclose

Restrict sensitive folders; approve or decline access requests as the process stages.

06

Close

Freeze uploads, export the evidence pack, hand it to counsel as the closing record.

A closer look

Beyond the vault: search, insight, and reach

Search across every document you can read, report on engagement, sync where your team already works, and wear your own brand end to end.

Know who's actually reading

  • Engagement overview

    Views, downloads, searches, logins and active users, per document and per stakeholder.

  • Branded PDF export

    One click builds a boardroom-ready engagement report in your own colours, not a generic export.

  • Prioritise follow-up

    See who has opened the financial model versus who has only logged in, and call the right people first.

Analytics · export
Data Room Engagement Report
Total views1,204
Downloads318
Active investors14 / 19
Top documentFinancial Model v4

Fits the systems you already run

  • SharePoint sync

    Every upload can mirror automatically into a configured SharePoint library, if your IT policy mandates it as the system of record.

  • Deterministic paths

    Files land at a predictable path by project code and folder, so nothing gets lost in translation.

  • Per-document sync status

    Admins see exactly which files have synced, and which have not, on the document itself.

SharePoint sync
/Deals/NORTHGATE-C/Data Room/Financial Model/Series C Financial Model v4.xlsx
✓ Synced 09:42
/Deals/NORTHGATE-C/Data Room/Cap Table/Cap Table (unsigned).pdf

Your brand, top to bottom

  • One codebase, many identities

    Wordmark, tagline, accent colours and logo resolve per deployment, by domain or by a single environment variable.

  • Every surface follows

    The sign-in screen, the room itself, watermarks and even the branded PDF export all carry the same identity.

  • Investors never see our name

    Each client gets a dedicated deployment, so stakeholders see your name and your colours, not ours.

Brand registry
Your Company
Gold accent · custom logo · your domain
Another Client
Indigo accent · own tagline · own domain
Answers to diligence questions in seconds, with a verifiable trail back to the source, instead of a week of email back-and-forth.
THE PROMISE OF EVERY DEAL DATA ROOM, ACTUALLY KEPT

Two sides of the room

Built for the people running the deal, and the people reviewing it

A data room only works if both sides actually want to use it. One side needs control and evidence. The other needs to find things quickly without being handed a password list.

For deal teams

Control, and the evidence to prove it

  • Invite per project, with separate read, upload and delete permissions for each person.
  • Approve or refuse folder access requests from a single admin queue, so nothing is granted by email.
  • Watch the audit trail fill in as investors read, download and sign.
  • Export that trail as CSV with actor, timestamp, event and document when counsel asks for it.
  • Set an expiry date on a document and it drops out of view automatically once it passes.
For investors and advisors

Ask, do not dig

  • Ask a question in plain English and get an answer with the source documents cited.
  • Nothing to install. It runs in the browser, on any device.
  • Request access to a folder you cannot see, without starting an email chain.
  • Sign in the room. External signers need no account at all, just a secure link.
  • Red flags surface on documents automatically, so diligence starts from a shortlist.

Before you ask

The five questions that actually stall a deal

Can an administrator edit or delete an entry in the audit trail?
No user of the application can, at any permission level. The audit table carries insert and read policies only. There is no update policy and no delete policy, so there is no route through the app, the admin screens or the API to change a row once written. Every entry is also stamped with a server-verified identity, so the actor on a row cannot be forged by whoever submitted it.For completeness: someone holding direct database infrastructure credentials sits outside the application's control, as with any system. We are happy to walk your technical reviewer through exactly how the policies are written.
Do investors need to install anything?
No. The room runs in the browser on any device, with no plugin, extension or desktop client. External signers do not even need an account: they sign through a secure tokenised link sent to their email address.
Can someone sign themselves up and get in?
No. Accounts are invite-only and the room exposes no public registration path. Access is granted per project, with read, upload and delete controlled separately for each person you invite.
What stops a downloaded document leaking?
Every PDF is watermarked on each page with the viewer's own email address and the time they opened it, so any copy that leaves the room is traceable to the individual who took it. Documents can also be marked view-only, which blocks the download path entirely rather than relying on the watermark alone.
What happens to documents that should not stay visible forever?
A document can carry an expiry date. Once it passes, the document drops out of view for everyone except administrators, enforced in the database rather than in the interface, so nobody has to remember to withdraw it by hand.

Stop emailing spreadsheets

Tell us about your deal and we will have a branded, role-based data room ready for your documents within days, with the AI already reading for red flags.

Deployed under your own domain and brand · invite-only access

More from Elevaition