Security

M&A due diligence involves some of the most sensitive financial data that exists. We take that responsibility seriously.

When you engage QoEAgent, you are sharing non-public financial information — trial balances, bank statements, lease agreements, and detailed transaction records for companies involved in active deal processes. The security architecture we have built reflects the gravity of that trust.

Encryption

All client data is encrypted at rest using AES-256 and in transit using TLS 1.3. Encryption keys are managed through dedicated key management services and rotated on a defined schedule. No financial data is stored or transmitted in plaintext at any layer of the stack.

Access Control

Access to client data follows strict role-based access control (RBAC) principles. Every team member operates under a least-privilege model — access is granted only to the specific resources required for a specific function, and no broader. Multi-factor authentication (MFA) is enforced for all personnel with access to production systems. Administrative access is logged, reviewed, and subject to periodic access reviews.

Client Data Isolation

Each client engagement is handled in a logically isolated environment. There is no cross-client data exposure by design. Data associated with one engagement is not accessible to, visible to, or commingled with data from any other engagement. Isolation is enforced at both the application and infrastructure layer.

Your Data Is Never Used to Train AI Models

This is a firm commitment: client financial data submitted to QoEAgent is never used to train, fine-tune, or improve any AI model — ours or anyone else’s. Your client’s confidential information is used exclusively to produce the analysis you requested, for the engagement you defined, and for no other purpose.

Audit Logging and Activity Monitoring

All data access, processing events, and administrative actions are logged to an immutable audit trail. Logs are retained in accordance with defined retention policies and are available to QoEAgent’s security team for review. Anomalous access patterns trigger automated alerts for immediate investigation.

Infrastructure and Hosting

QoEAgent is hosted on SOC 2-compliant cloud infrastructure. All data processing occurs within the United States. We do not transfer client data to international jurisdictions. Our infrastructure providers maintain their own rigorous security certifications, and we conduct periodic reviews of their compliance posture as part of our vendor management program.

Confidentiality and Contractual Protections

Every engagement with QoEAgent is conducted under a non-disclosure agreement. We treat all client financial data as strictly confidential, consistent with the professional obligations that govern the M&A advisory industry. Our team members are bound by confidentiality obligations and receive regular training on information security practices.

Data Retention and Deletion

Client data is retained only for the duration necessary to complete an engagement, plus any contractually required retention period. Upon engagement close or at the client’s request, data is purged from our systems in accordance with documented deletion procedures. We do not retain copies of raw client data beyond defined retention periods.

Incident Response

QoEAgent maintains a documented incident response plan. In the event of a security incident that affects client data, we are committed to prompt notification, transparent communication, and coordinated remediation. Our incident response procedures are reviewed and updated regularly.