BUILT FORZERO TRUST.
Lengdon assumes no party should be trusted by default — including us. Every control exists to protect both parties from each other, from the platform, and from time.
EIGHT CONTROLS.
ALL MANDATORY.
Encryption at rest and in transit
All data is encrypted using AES-256 at rest and TLS 1.3 in transit, provided by our infrastructure providers (Cloudflare, Supabase) and confirmed independently against their own security documentation. No Lengdon employee has access to transaction content.
Per-person NDA enforcement
Every participant — not every company — signs an individual NDA before accessing the room. Access is granted to named individuals, not to organisations or teams. There is no 'company-level' access.
Append-only, tamper-evident record
Every action taken in a room is written to an append-only log. No entry can be deleted, modified, or reordered. Altering any earlier entry is detectable — the record makes tampering evident, not merely logged.
Individual authentication
Every participant authenticates as a named individual — there is no shared or company-level login, and access is granted per person, never per organisation. Authentication events are recorded individually in the audit log. Multi-factor authentication is not yet available; it is planned before signups open to the public, and we say so rather than imply a control that isn't there.
Role-scoped access
Each participant receives only the access their role requires for the current stage. Documents not yet released at the current stage are inaccessible — not hidden, not locked — simply not visible to the other party.
No money movement
Lengdon is software infrastructure, not a regulated financial institution. We never handle, hold, escrow, or route funds. Payment confirmation is recorded — proof of transfer is uploaded and counter-confirmed between the parties — but no financial instrument passes through our infrastructure. We work alongside your counsel, escrow agent, and compliance function; we don't replace them.
Reference-checkable record
Every closed deal gets a unique reference number that identifies its record without exposing terms, party identities, or document content. Both parties can cite it at any point after close.
Independent record
The full audit trail is preserved after close, unchanged, for both parties. It documents exactly what happened — every step, confirmation, and signature — for as long as the deal room exists.
THE APPEND-ONLY
RECORD.
Every action is written to a permanent, append-only log where each entry references the one before it. Altering an earlier entry breaks that reference — visibly, and permanently.
Condition Met: Regulatory Approval
ATLS01-ROM-2026-000017-91Term Accepted: Board Seat
ATLS01-ROM-2026-000018-88Document Released: Cap Table
ATLS01-ROM-2026-000019-85WE TEST IT BY
USING IT.
We build every internal control from a shared component set, and we verify it by operating it — tabbing to a control, pressing Enter or Space, confirming a screen reader would have something to say about it. That has already caught real problems: an admin toggle with no keyboard access, five document-upload controls a keyboard user couldn't operate at all, and a shared form-field component whose labels weren't wired to their inputs.
What's fixed today: every custom interactive control we've audited — elements standing in for buttons, sortable table headers, drag-and-drop cards — now exposes a real role, keyboard focus, and a keyboard-triggerable action. Every form built from our shared field component has its label programmatically tied to its input, verified by confirming that keyboard focus actually moves when the label is activated.
What's still open: that fix hasn't reached every form yet — a number of individual fields, including on our public calculators, still need labels wired by hand. Everything above was found by manually operating the product; we've since added an automated accessibility scan to our build pipeline as a second check, not a replacement for it.
We're not claiming WCAG conformance. We're telling you what we've verified, what we haven't gotten to, and that a control nobody can operate with a keyboard is a defect here, not a nice-to-have.
WHAT WE RUN ON,
AND HOW WE CHECK IT.
Our infrastructure runs on SOC 2 Type II and ISO 27001–certified providers: Cloudflare (network, edge, hosting) and Supabase (database, authentication, storage). Payment processing runs through Stripe, which holds PCI DSS Level 1 certification and SOC 2 Type II. Email delivery and CRM run through Resend and HubSpot, both SOC 2 Type II certified.
Every table in our database enforces row-level security — 140 of 140, checked directly against the live database, not assumed from documentation. Our production traffic runs behind a Content Security Policy with a unique cryptographic value per page load, verified to block a real attempt at unauthorized script injection, not just left unconfigured. Every code change passes an automated build and type-check gate before it ships, plus a dependency vulnerability scan on every commit.
Every uploaded document is checked against its actual file content, not just its filename — a file whose real format doesn't match what it claims to be is rejected and removed automatically.
We do not yet run a scheduled, automated penetration-testing program. We've run one manual automated scan to date — it produced a false finding that we caught by attempting to reproduce it, which is now a standing rule in how we evaluate security tooling internally. We treat penetration testing as a standing practice, not a one-time event, and are expanding its frequency and scope as the platform grows.
In progress
Malware scanning on uploaded documents is planned but not yet built. Signups are closed during this phase, which is the reason this can wait — it is not a claim that scanning is already in place today.
Full technical documentation of our security controls and encryption implementation is available on request for institutional due diligence. We do not yet hold a SOC 2 attestation or an independent penetration-test report — both are on our roadmap, not achieved today, and we say so directly rather than leave the question open.