Security
How a client data room is handled
A pre-investment screening means handling a confidential project file. This page describes the controls that apply, at a level appropriate for a client's own review — it does not disclose exploit-sensitive implementation detail.
Isolated mandate workspaces
Each engagement's data room sits in its own workspace, namespaced to that mandate. One engagement's documents are never combined with, or reachable from, another's.
Hash at intake
Every file is SHA-256 hashed the moment it is received and recorded in a data-room index. Nothing is silently discarded; duplicates and superseded versions are tracked.
A secure ingestion boundary
Client files pass through a trust boundary before any processing: file-type identification, size limits, archive-bomb controls, malformed-document handling, and macro / embedded-object detection. Anything that cannot be handled safely is held for manual review rather than processed.
No document code execution
A client-supplied file is treated as data, never as code. Nothing in a data room is executed, and client text is never used as an instruction to any automated step.
Manifest integrity
The report is bound to its evidence set and methodology versions by a manifest whose stage hashes can be recomputed from the underlying bytes — an altered artifact is detectable.
Audit trail
Workflow actions — file received, evidence reviewed, contradiction resolved, verdict generated, report signed, package delivered — are recorded in a hash-chained log that detects edits, deletions, and reordering.
Controlled retention
Retention and deletion follow the policy agreed in the engagement. A deletion produces a record of what was removed, when, and on what basis.
What is not claimed
BiP Omega does not hold a SOC 2 report or an ISO 27001 certification and does not claim a third-party penetration test. The controls above are BiP Omega's own, tested by BiP Omega's own security and workflow red teams. Integrity is protected by hashes and an audit trail — this is tamper-evidence, not cryptographic non-repudiation, and no forensic-secure-erase is claimed unless one is actually performed.
A prospective client can request the full security and threat-model documentation for review under a mutual NDA.