Product / Security

What Dealkan enforces, and where its limits are.

Kuartal ID sign-in, encryption in transit and at rest, and link rules checked on the server. Dealkan is not end-to-end encrypted, and we say so plainly.

No security certification is claimed. These notes describe the code in this release.

01 / Sign-in

Sign-in

Your team signs in with Kuartal ID (OpenID Connect with PKCE). Dealkan stores no passwords for workspace users.
Sessions use a host-only, secure, HttpOnly, SameSite=Lax cookie on the app domain and end after 30 idle minutes by default.
Sensitive actions, such as deleting a room or managing the team, can require a fresh Kuartal ID sign-in.

02 / Encryption

Encryption

In transit: HTTPS only, with HSTS on the app domain.
At rest: uploaded files and their previews are encrypted with AES-256-GCM before they are written to private storage, outside the public web root.
Not end-to-end: the server holds the key so it can decrypt a file and show it to a viewer your link allows.

03 / Link rules

Link rules

Password (stored hashed), expiry, email and domain allowlists, NDA acceptance and download permission are checked on the server before a file is sent.
Revoking a link stops further access through the viewer at once.
Every upload is virus-scanned and stays blocked until the scan passes.

04 / Records

Records

An audit log records changes to the room and every viewer access decision. Entries cannot be edited from the app.
Viewer activity (opens, pages, time per page, downloads) is shown only to the room owner and editors.

05 / Limits

What no browser-based data room can guarantee.

Screens and cameras

A web page cannot stop a phone camera or an operating-system screenshot. Focus blur, disabled printing and per-viewer watermarks deter casual capture and make a leak traceable. They are not a substitute for a confidentiality agreement.

Downloaded files

Revoking a link cannot delete a normal PDF that someone has already saved. Keep downloads off until you need them; stronger offline controls would need a protected viewer.

Dealkan · by Kuartal

One room per deal. Rules on every link.

Sign in with your Kuartal ID, create a room, upload a document and send a link with the rules you choose. For anything specific to your transaction, write to hello@kuartal.id.