Designed for
the strictest
data rooms.

Each organisation lives in its own workspace. Every file is encrypted with a per-organisation key (KEK) wrapping a per-file data key (DEK), so data never crosses tenant boundaries even at the storage layer. We do not train our own models on customer documents.

For Enterprise customers, we can provision a fully dedicated tenant in the EU region of your choice, with your own key management integration (AWS KMS or customer-managed HSM) on the 2026 roadmap.

Your documents, financial models, and report drafts are processed only to provide the service to your organisation. We do not train our own models on customer content, and our LLM provider configuration and contracts are designed to opt customer content out of model-training use.

Provider-side logs, temporary file references, and prompt caches are managed under provider terms, our DPA, and the deletion lifecycle described below.

undrsight is a Belgian company operating on European infrastructure. Core application hosting and deal-document storage are in the European Union, with international transfers limited to approved sub-processors and governed by our DPA and Standard Contractual Clauses where applicable.

For LLM inference, the inputs needed to produce the requested analysis may be sent to approved API providers outside the EEA under transfer safeguards. Enterprise customers with stricter requirements can scope dedicated regional processing controls as part of the contract.

Every action in undrsight is logged: who uploaded what, when, who read which finding, who exported which report. The audit trail is immutable-append-only, exportable as CSV today — ready for your internal compliance team or external auditors.

TOTP-based multi-factor authentication can be enabled per user account today. SSO via SAML 2.0 / OIDC, SCIM provisioning, and IP allow-listing are on the 2026 roadmap for Sovereign customers — reach out if you need them on a pilot.