Privacy
How Docsroom handles personal data. Version of 2026.
Who we are
Docsroom provides secure data rooms. For the documents and people in your rooms, your organisation is the controller and Docsroom is the processor, under a data processing agreement. For your own account and billing, Docsroom is the controller.
What we store
Your name, work email and company; the rooms you make and who you invite; the files you and your guests upload (encrypted); and an activity log of views, downloads, uploads and changes, with time and IP address. We do not sell data and do not use your documents for anything other than showing them to the people you allow.
How files are protected
Every file is encrypted with its own key, and that key is locked by a key per room, held in a key management service. File and folder names are encrypted the same way. Files are scanned for malware before anyone can open them. Guests log in with a one-time code; pages they view carry their email as a watermark when the room is set to do so.
How long we keep it
Files stay until you delete them or close the room. Closing a room destroys its key, after which its files, including backups, cannot be read by anyone. The activity log is kept for the life of your account so you can prove who saw what. Account data is deleted within 30 days after you end your subscription, invoices are kept as long as tax law requires.
Who helps us
These providers process data for us, each under a data processing agreement:
Your rights
You can ask to see, correct, export or delete your personal data, and object to processing. Guests can ask the organisation that invited them, or us. You may also complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
Contact
Questions about privacy: use the contact form on the demo page and we answer within one working day.