Trust · Security & confidentiality
Your deal flow stays in your tenant. Not with ours.
BD and M&A material is sensitive. Concordat Bio is built so a single customer is the only audience for its own workspace — pipelines, targets, draft term sheets, and financial models. No analyst carries your files. No consultancy back office reads them. No engagement hands them off to the next one.
Tenant & workspace isolation
One tenant per customer, by design. Not by configuration.
The default posture is isolation. Customer A and customer B do not share a database, do not share an embedding index, and do not share a document corpus. The structure of the platform is what keeps your material private — not a setting your competitor could ever toggle off.
One workspace per customer
Each customer has its own workspace — a discrete environment with its own users, documents, and watchlists. There is no shared tenant, no shared database, no shared file surface.
What stays inside
Declared portfolio gaps, target lists, draft term sheets, financial models, diligence notes — everything you commit to Concordat stays inside that workspace and is visible only to the people you have invited.
What never crosses over
No cross-tenant reads. No cross-tenant embeddings. One customer’s pipeline intelligence is not surfaced, ranked, or reused for another customer, and never informs a scoring model that another customer sees.
How we handle your data
What you should be able to read in plain English.
These are the controls a BD or legal lead needs to know before sharing a target list or a draft term sheet. The deeper technical specification is available in the security packet under NDA.
Encryption in transit and at rest
Your workspace traffic is encrypted in transit. Workspace data is encrypted at rest. The specific cryptographic controls are documented in the security packet — what is described here is what you actually need to know to trust the environment with deal material.
Named users only
Only the workspace members you authorize can sign in. Access is scoped to that workspace — a user in customer A cannot read or write anything in customer B. There is no shared admin account, no consultancy “back office,” and no analyst account that floats between engagements.
Tenant-scoped permissions
Workspace owners control who sees a given document, who can edit a draft term sheet, and who can act on the agents. A deal team can be widened during diligence and tightened back down afterwards, on your instruction, with the audit trail intact.
Operational baselines
Backups, audit logs, monitored infrastructure, and isolated database instances per tenant (or row-level isolation where the deployment shape makes that appropriate) — the operational defaults that a BD leader needs to know are in place before the first document is uploaded.
Confidentiality commitment
Your BD material is never used to inform or benefit another customer.
Your pipeline gaps, your target lists, your draft term sheets and integration playbooks — the material that defines your BD strategy — is yours alone. It is not used to train a shared model. It is not surfaced, intentionally or incidentally, to another customer. It is not blended into a generic “market intelligence” feed that a different engagement reads.
Concordat Bio does not run a corpus of customer documents the way a consulting firm runs a corpus of past engagement files. The platform is the product, and the product’s outputs for each customer are bounded by that customer’s workspace. The commitment is operational, contractual, and architectural — not aspirational.
Always-on desk vs. a consulting engagement
Where sensitive BD material sits, and who has access to it.
Concordat Bio covers the same ground — pipeline sensing, target scoring, term-sheet drafting, financial modeling, integration planning — but does so from an isolated tenant rather than a shared project team. The structural differences matter when the material is sensitive.
Security review
What your security review will see.
Data flow diagrams, sub-processor list, infrastructure summary, and standard questionnaire responses are available under NDA. We do not publish these publicly — they describe the deployment surface in enough detail to be useful to a reviewer and not useful to a competitor. Email concordat-bio@polsia.app with the subject “security packet” and we will share the documents and arrange a call with the technical lead.
- Architecture. Tenant model, data flow, encryption boundaries, and the agent runtime.
- Sub-processors. The named infrastructure providers your customer data touches, with their regions and data-handling commitments.
- Questionnaires. SIG / CAIQ-style responses for the controls a procurement or infosec team wants to see.
Get started
Put Concordat Bio through your security review before you commit a target list.
Pilots run on a single high-priority candidate for one customer-defined portfolio gap — one workspace, one NDA, one set of deliverables. If the security posture and the BD outputs both hold up, you decide whether to expand.
Concordat Bio · Basel, CH · Tenant-isolated SaaS.
Direct line
concordat-bio@polsia.app