How Onward protects your information

Updated November 1, 2026. When this page changes, the date changes.

Selling or buying a business means sharing things you'd never post publicly: tax returns, bank statements, what you'd accept for the company you built. This page explains, in plain terms, how Onward keeps that information safe and who can see it.

Your documents are encrypted before they're stored

• When you upload a document to your vault, Onward encrypts it before it leaves our application, using AES-256-GCM, the same standard banks and governments use.
• Every document has its own key. That key is itself locked with a separate master key that is never stored in our database or alongside your files.
• Your file is kept in private cloud storage as unreadable ciphertext. Someone who got hold of the storage alone, or the database alone, would not have a readable document.
• When you delete a document, we destroy its key straight away, so the copy in storage can no longer be opened.

Only the people you choose can open your documents

• Nobody can open a document in your vault until you share it, whether that is another member, a broker or Onward staff.
• Financial documents can only be shared with a buyer who has signed an NDA with you.
• Every time someone other than you opens a document, Onward checks, at that moment, that they still have access. If you revoke a share, it stops working immediately.
• Copies opened by anyone else are watermarked with who opened them.
• You can see every open. Your vault shows who opened which document and when, including any time Onward staff opened one, for example to check proof of ownership. Staff can open a document only while that review is in progress, and every time staff look at a member's record it's written to a log nobody can edit.

Your name and your business's name

Your listing never shows your name, your business's name or its address. You decide, conversation by conversation, when a buyer gets to see them. You can wait until they've signed an NDA, or share sooner if you prefer. If you share before an NDA is signed, Onward reminds you what that means first.

Signing in

• There are no passwords to steal or reuse. You sign in with a one-time link sent to your email. Each link works once and expires in 15 minutes.
• Your session is stored on our servers, so if we ever need to end it (for example, if an account is misused), that happens instantly. A session ends 90 days after you sign in, and you can sign out of every device at once from Settings.
• Session cookies are marked so that only Onward's servers can read them, over encrypted connections only. We keep only a scrambled fingerprint of each session, so even a copy of our database couldn't be used to sign in as you.

Connecting your bank or accounting software

• Plaid (your bank): we request only your bank statements, nothing else.
• QuickBooks: we read your reports; we can't change anything in your books.
• Access keys for either connection are encrypted, kept only for the few minutes the import takes, then deleted and the connection is closed.
• The statements and reports you choose to keep are saved in your vault, encrypted like any other document.

Personal financial statements

• If you're a buyer completing an SBA Form 413 in Onward, we don't collect your Social Security number or account numbers. The server discards those fields even if they're sent.
• The values you enter are encrypted.

Payments

• Card payments are handled by Stripe. Onward never sees or stores your card number.

AI features

• Provider and retention. When you use Onward's AI features, your request goes through Vercel's AI Gateway to providers with zero data retention. They don't keep your information after answering, and they don't use it to train their models. The privacy policy names which provider each feature uses.
• Document reading is off until you turn it on. It only reads your own files. Files someone else added to your data room are never read.
• Turning it off deletes its results.
• Strict separation in our database. Document reading runs under a restricted database role that can see only the business it's working on.

Analytics stay off your private pages

We use product analytics to see which parts of Onward people use. Those tools never load on the pages that show your documents, your financial statements, your data rooms, or your NDAs and letters of intent.

Our infrastructure

• Encrypted connections. All traffic to Onward is encrypted with TLS 1.3, and browsers are told never to connect without encryption.
• Hosting. Onward runs on Vercel, and our database is Neon Postgres. Both encrypt stored data at rest.
• Backups. The database is continuously backed up with 7-day point-in-time recovery, and we rehearse restoring it.
• Signed messages from our providers. Notifications from Stripe, our email provider and our video provider are cryptographically verified before we act on them.
• Code changes. Every change goes through automated checks before it can reach production, and our source code is private.

Companies that process your information for us

Deleting your information

• Documents: you can delete any document at any time, and deletion takes effect immediately.
• Your account: to delete it, email privacy@onwardlegacy.com.
• Backups: deleted information may remain in encrypted database backups for up to 7 days before it ages out.

Reporting a security concern

If you think you've found a security problem, email security@onwardlegacy.com. We'll acknowledge it within two business days.

What we're working on

Onward is new, and we'd rather be straightforward about it. We completed a full security review of our code and infrastructure in November 2026 and are working through what it found. We plan to commission an independent penetration test once that work is done.