Confidentiality & security
Selling or buying a business is confidential. Here is exactly what we store, who sees it, and how we protect it, without marketing language.
Our principles
- Anonymous by default
- Business names, cities and documents are disclosed step by step, only after both sides agree.
- Only what's needed
- We ask for the data the valuation and matching need, and nothing else.
- No tracking, no ads
- No analytics or advertising cookies, no third-party scripts, no data sales.
- You stay in control
- Export or delete everything yourself, any time, without asking us.
What we store, and who sees it
| Data | Why | Who sees it | How long |
|---|---|---|---|
| Account: name, email, password hash | To log you in | Only you (and admins for support) | Until you delete your account |
| Business details and valuation | Valuation, handover readiness, listing | You; the anonymous listing is public once published | Until you delete your account |
| Buyer profile | Matching | You; matched owners see a summary without your name | Until you delete your account |
| Messages and documents | The deal process | You and the other party of that deal (documents after NDA) | Until one of you deletes their account |
| Usage statistics | Improving the product | Our team, as anonymous counts | No personal data stored |
Cookies and browser storage
Only strictly necessary cookies: one keeps you logged in, one remembers the market you chose at the top, and in demo mode one remembers your persona (plus a short-lived one for the second step of two-factor login). Your questionnaire answers stay in your own browser so you don't lose progress, and you can delete them with one click.
Full list in the privacy policyWhere your data lives
- WebsiteVercel Inc. (USA), region Frankfurt am Main (fra1)
- Database and documentsSupabase Inc. (USA), project region Frankfurt am Main (eu-central-1)
- AI text suggestionsAnthropic PBC, USA (only when you click, without business names or figures)
All connections are encrypted (HTTPS). Details on Art. 28 GDPR agreements and transfers to third countries are in the privacy policy.
Security measures
| Measure | Protects against |
|---|---|
| Checks by Erbelo: revenue and earnings against the financial statement; ownership, financing and qualification against documents, which are deleted afterwards. Not an audit, no guarantee. | False claims, non-serious requests |
| Passwords stored only as bcrypt hashes (cost 12); at least 10 characters; common passwords rejected | Stolen databases, guessing |
| Every input checked for type, length and range on the server | Corrupted or malicious data |
| Access log: every time a document is opened is visible to both sides in the deal room | Unnoticed access |
| Changing your password signs out every other device; "Sign out on all other devices" anytime | Stolen or forgotten sessions |
| Encrypted connections everywhere (HTTPS, HSTS for two years) | Eavesdropping and tampering in transit |
Show all 19 measures
| Measure | Protects against |
|---|---|
| Strict Content Security Policy with a new random key per request; no third-party scripts | Injected scripts (cross-site scripting) |
| Erbelo can't be embedded in other sites' frames | Clickjacking |
| Login attempts limited per address and per account; failed logins take the same time whether or not the account exists | Brute-force attacks, account discovery |
| Two-factor login with an authenticator app for every account; required for admins | Stolen or guessed passwords |
| Login attempts limited across all servers (in the database, stored only as an encrypted check value) | Brute-force attacks spread over many servers |
| Every demo visit gets its own separate copy of the example data | Visitors interfering with each other in the demo |
| Signed session cookies: HttpOnly, Secure, SameSite, host-only prefix | Session theft, cross-site request forgery |
| Origin checks on every form action | Cross-site request forgery |
| Access check on every deal, message and file; the same answer for 'missing' and 'not yours' | Users seeing each other's data |
| Uploads checked by their real content, max. 4 MB, always downloaded and never displayed in the browser | Malware disguised as documents |
| Database access only through parameterized queries | SQL injection |
| Every listing reviewed before it goes live | Fake or fraudulent listings |
| Fonts and all code served from our own servers | Leaking visits to third parties |
Not in place yet
Coming next: email address verification, an independent penetration test and additional encryption of documents.
- E-mail address verification
- Independent penetration test
- Additional encryption of documents by Erbelo (today: the EU provider's encrypted database)
Your rights, in two clicks
In My Erbelo: "Download my data" gives you everything we store about you as a file. "Delete my account" removes your account, business or profile, contacts, deals, messages and documents immediately.
Found a vulnerability?
Please tell us privately first. Our contact details for security reports are in /.well-known/security.txt. We respond quickly and credit responsible reporters.
Read the privacy policy