Security
Is it safe to upload a data room to an AI due diligence tool?
It can be, if the tool answers five questions plainly: does the AI provider keep your files, are they used for training, how are they encrypted, who can open them, and where are they processed. Here are our answers.
Short answer: it can be, but "we take security seriously" doesn't answer anything. Before a fund uploads a data room to any AI tool, it should get a plain answer to five questions. Here they are, with Aventro's answers, so you have something to compare other tools against.
1. Does the AI provider keep a copy?
Most AI tools send your documents to a model provider such as OpenAI. Unless the tool has a zero data retention arrangement, the provider may keep requests for a while, usually for abuse monitoring. Ask whether every call runs with zero data retention, meaning the provider keeps nothing once it has answered.
Aventro: every model call requires zero data retention. If a request can't get it, the request fails instead of going through.
2. Is my data used to train models?
Get the answer in writing, in the terms.
Aventro: no. We don't authorize our AI providers to train on your content, and our terms say so.
3. How are the files encrypted, and with whose key?
Encryption in transit is the floor. Ask about encryption at rest, and whether one key protects every customer's files.
Aventro: every document is encrypted with AES-256-GCM under a key derived for its own deal. A key for one deal opens nothing else.
4. Who inside the tool can open it?
Ask how access is granted: per workspace, per deal, per person. And ask what the AI can change on its own.
Aventro: access is per deal and per person. A founder sees only what the fund sends them, and the fund's diligence and decision stay inside the fund. Aventro AI reads the record and drafts, but nothing it writes is saved until a person confirms it.
5. Where is it processed, and by whom?
Ask for the subprocessor list. If a vendor can't name every company that touches your data, that's your answer.
Aventro: the database and your documents are stored in Frankfurt, Germany. Model calls go through Vercel AI Gateway, with zero data retention, to OpenAI's models for reading and drafting and Microsoft's for transcribing call recordings. The gateway chooses the region for each request rather than pinning one. Every subprocessor, what it does and where, is on our public subprocessors page.
One more test worth running
During any trial, upload a document with a deliberately wrong number in it and see whether the tool notices. The five questions tell you whether your data is safe there. That test tells you whether the tool is worth giving it to.
The long version of our answers is in the security overview.