For your compliance officer

Security summary.

Every retained search includes a private deal room for the approved target list, company dossiers, owner-conversation notes and shared documents. Its operating arrangements are agreed before work begins.

What the deal room is

The room supports your search and your team. The sample on the home page uses fictional data and is not a client room.

Access and continuity

Client-room access, backup, recovery and export arrangements are confirmed before the engagement begins.

How the data is protected

• Client-room access and security controls are confirmed for your engagement before work begins.
• We do not offer a data-residency guarantee. Cloudflare uses a global network, so content can sit outside the United States.
• Client information is not used for advertising or shared with website analytics providers.

How the data is used

Only to run your search. Old Soldier does not sell, share or pool client data, does not use one client's room to inform another client's search, and does not put client-identified data into public AI tools. Where AI drafting tools are used to prepare dossiers, they run under business terms that exclude the data from training, and your name and confidential terms are not included in prompts.

If something goes wrong

Old Soldier notifies your designated contact within 72 hours of confirming any unauthorized access to your room, describes what was affected, and says what has been done about it. Affected owners are notified where their confidential information was exposed.

Subprocessors

There are two lists here and only one of them is ours. Ours names every provider Old Soldier engages that touches client data: the hosting provider for the rooms, the access provider that issues sign-in codes, the CRM, email and file storage, the phone system, the company research data providers and the AI drafting tools described above. We keep that list current, it is provided with the data-processing addendum, and you are told before a name is added to it. The second list is the vendors each of those providers uses in turn. Every one of them publishes its own and we will point you to them, but they are not ours to compile and we will not pretend otherwise.

Last updated September 8, 2026.