“Enterprise-grade security” means nothing — verify these instead

• Security
• Trust

Read enough data-room marketing and the security pages blur into one. AES-256 at rest. TLS in transit. Two-factor authentication. SOC 2 underway. The phrase "enterprise-grade security" gets stamped on top, and you are expected to feel reassured.

You shouldn't. Those are table stakes — the floor, not a differentiator. Strong encryption and 2FA are necessary, but every serious vendor has them, which means they tell you almost nothing about whether this provider will protect your confidential deal. A security page that leads with AES-256 is answering the easy question loudly to avoid the hard ones.

So ask the hard ones. Three properties actually separate a data room you can trust from one that merely sounds secure.

1. Is the audit trail tamper-evident — or just a log?

Most "audit logs" are ordinary database rows. Anyone with write access to that database — an insider, an attacker who got in, the vendor themselves under pressure — can edit or delete an entry, and you would never know. A log you cannot trust after a breach is not evidence; it is a story.

The property that matters is tamper-evidence: the record is structured so that altering or removing any past entry is detectable. The strongest form chains each entry cryptographically to the one before it and periodically anchors that chain to write-once, immutable storage that even the vendor cannot rewrite. Then "here is what happened" becomes a claim you can verify rather than one you have to take on faith. Ask whether deleting a single audit row would be detectable. If the honest answer is no, the audit feature is decorative.

2. Are access decisions re-resolved at the moment of access?

Permissions change. Someone leaves the deal, an NDA lapses, a room closes. The question is whether the system notices at the instant a document is fetched. Many designs decide access once — when a link is minted or a session opens — and then trust that earlier decision. Revoke someone, and a token issued five minutes ago may still work.

The property to demand is runtime re-resolution: every view and every download re-checks entitlement against the live source of truth, treats the visitor's token as a claim to be verified rather than authority to be honored, and fails closed when anything is ambiguous. Revocation should take effect on the very next request, not the next session.

3. How is one tenant's data isolated from another's?

In multi-tenant systems, the boundary between your data and someone else's is the whole game. Ask exactly what enforces it — application checks, storage policies, cryptographic key separation — and where the residual risk sits. A vendor who can answer precisely is one who has thought about it; "it's all encrypted" is not an answer.

At Waafir we built the first two as load-bearing guarantees, not checkboxes: a hash-chained, write-once-anchored audit trail you can independently verify, and view-and-download access that is re-resolved at runtime and fails closed. We would rather tell you exactly how the walls are built than stamp "enterprise-grade" on the box and hope you don't ask.