Security
Built for firms that can't take chances with client data
The controls below reflect our production architecture. See our Privacy Policy, Subprocessors, and FAQ for plain-language answers to the questions your security team will ask.
AES-256 Encryption at Rest
Your contract text and every piece of derived analysis that can contain a quoted excerpt — findings, AI explanations, review notes — are encrypted with AES-256-GCM before they touch the database. A fresh random nonce is generated for every write, and the encryption is authenticated: any tampering with stored data is detected, not silently accepted. Keys support rotation without downtime.
Encrypted in Transit
Connections are secured with TLS end-to-end. We enforce HTTPS with HSTS, plus a strict Content-Security-Policy, clickjacking protection, and MIME-sniffing protection on every response — the standard security-header set security reviewers check for, all present by default.
Two-Factor Authentication
Every account can require a code from an authenticator app (Google Authenticator, Authy, 1Password) in addition to a password, with single-use recovery codes for backup access. Passwords themselves are salted and hashed with PBKDF2-HMAC-SHA256 — never stored or logged in plaintext.
Strict Access Control
Every contract and playbook lookup is scoped to your account in application code. Cross-customer document access is blocked by design and covered by automated tests in our release suite (contracts, playbooks, review actions, and imports). Administrative access is role-based and individually granted, never a shared password, and every admin action is logged.
A Controlled Boundary Around AI
Deterministic policy engines decide governed outcomes. OpenAI may receive contract content and analysis context as required by the features enabled for your account — which can range from short excerpts to broader passages or full document text depending on configuration and use. The AI assists with evidence discovery and plain-language explanation but cannot create authoritative policy outcomes or change your risk score. Your documents are not used to train models. Decision–explanation separation is formalized as a trust property in our IEEE TPS 2026 paper, building on the deterministic execution boundary accepted at ICCS 2026. See our Subprocessors page and Privacy Policy for data flows and transfer details.
Deterministic, Traceable Findings
Each deterministic finding includes a traceable rule ID, matched excerpt, and rationale — recorded alongside the rule-engine version used. Given the same inputs, the deterministic layer produces the same results; it does not probabilistically invent or drop findings. Coverage is limited to the rules and policies configured for your account, not an open-ended claim to catch every possible issue. Reproducibility and rule-level traceability are the TP1/TP2 properties evaluated in our IEEE TPS 2026 research.
Hardened Uploads
Every upload is validated against its claimed file type at the byte level (not just the filename), checked for zip- and PDF-bomb characteristics, and sanitized before extracted text is persisted — regardless of what a browser or a malicious upload claims about itself. Original file bytes are not written to disk.
Full Audit Trail
Logins, uploads, exports, deletions, sharing activity, playbook changes, and admin access — every one is recorded with who, what, and when in an append-only log, so unusual activity is investigable, not invisible.
You Control Deletion
Delete any single contract, permanently, at any time — the text, findings, and any share link created from it are removed in one action, not hidden behind a flag. Deleting your account removes everything associated with it. Every deletion is logged. Automated server backups on Hetzner Cloud use a 7-slot rotation; deleted data may persist in backups for up to approximately seven days.
Protected Sharing
When you share a report link, you control it: optional password protection, an optional expiration date, an optional maximum number of views, and revocation at any time. Every access to a shared link is logged.
Have questions your security team needs answered?
We'd rather give your security or privacy team a straight, factual answer than a marketing one. Review our Subprocessors list or reach out directly.
Talk to Us