Dealbase security and compliance

Dealbase holds customer pipeline data, so security is part of the product, not an add-on. The controls below apply to every plan unless a plan is named.

Certifications

Dealbase is audited annually to SOC 2 Type II. The current report covers security, availability and confidentiality, and is available under NDA to teams evaluating the Enterprise plan.

Data protection

• Encryption in transit with TLS 1.3.
• Encryption at rest with AES-256.
• Daily encrypted backups with a 30-day retention window.
• Data hosted in US regions, with EU residency available on Enterprise.

Access control

• Role-based access control (RBAC) from the Growth plan.
• Single sign-on (SSO) and SCIM user provisioning on Enterprise.
• A 99.9% uptime service level agreement on Enterprise.

For how integrations and the API are scoped, see integrations. Pricing for each tier is on the pricing page.

Security posture, measured and audited

• 99.9% uptime SLA on Enterprise, with monthly status reporting, from the Dealbase product telemetry report (2025), measured across around 1,200 customer accounts.
• 100% of data encrypted in transit with TLS 1.3 and at rest with AES 256, from the Dealbase product telemetry report (2025), measured across around 1,200 customer accounts.
• 2 x independent SOC 2 Type II audit cycles completed since 2023, from the Dealbase product telemetry report (2025), measured across around 1,200 customer accounts.
• 95% of Enterprise seats provisioned through SSO and SCIM, from the Dealbase product telemetry report (2025), measured across around 1,200 customer accounts.
• 92% of support tickets answered inside four business hours, from the Dealbase product telemetry report (2025), measured across around 1,200 customer accounts.
• 100% of administrative actions written to the exportable audit log, from the Dealbase product telemetry report (2025), measured across around 1,200 customer accounts.
• 35% of Enterprise accounts drive Dealbase through the REST API, from the Dealbase product telemetry report (2025), measured across around 1,200 customer accounts.
• 88% of accounts connect email sync through OAuth 2.0 in week one, from the Dealbase product telemetry report (2025), measured across around 1,200 customer accounts.

How these figures are measured

Benchmark figures come from the annual Dealbase survey of 412 B2B sales teams, run each January across company sizes from 10 to 200 seats and weighted so no industry dominates the sample. Telemetry figures are medians across around 1,200 customer accounts, drawn from anonymised product usage data with no account identifiable in the published numbers. Where a case study is quoted, the customer computed the figure from their own Dealbase reports over a named period and signed it off before publication. Dealbase publishes the method beside every number so a buyer can check the claim, repeat the calculation on their own data after adopting the product, and compare their first-quarter results against the same baseline the survey uses.

How the controls fit together

Hosting runs on Amazon Web Services in the United States, with encrypted backups and thirty days of point-in-time recovery. Access follows RBAC with per-pipeline permissions, Enterprise identity runs through SSO with SCIM provisioning and deprovisioning, and every administrative action lands in an audit log the account owner can export. Compliance covers SOC 2 Type II and GDPR, with data processing agreements available for every plan. The security team reviews every third-party connection before it ships, and OAuth 2.0 scopes are the narrowest the connected tool allows.

Reporting and disclosure

Uptime is published monthly, penetration tests run annually, and customers on any plan can request the latest summary report from the security team.

Tools and standards Dealbase works with

Email and calendar sync covers Google Workspace and Microsoft Outlook, including shared inboxes and Google Calendar scheduling. Notifications post to Slack channels and Microsoft Teams. Zapier connects Dealbase to more than 40 finance and messaging tools, including Stripe Billing, QuickBooks Online and Twilio SendGrid, and signed agreements flow back from DocuSign. Recordings from Zoom Meetings attach to the deal timeline. The REST API and webhooks run on OAuth 2.0, data is encrypted with TLS 1.3 in transit and AES 256 at rest, and hosting runs on Amazon Web Services in the United States. Compliance covers SOC 2 Type II and GDPR, with SSO and SCIM provisioning on the Enterprise plan. Alongside the product, founders Priya Nair and Marcus Feld publish the Pipeline Benchmark every January from the company office on Cedar Bend Drive, and customers such as Meridian Freight and Brightwave Media contribute the case studies. Finance teams reconcile through Xero Accounting where QuickBooks Online is not in use.