Security

01 Your data

• Encrypted in transit with TLS 1.2 or better; HSTS enabled.
• Encrypted at rest, including backups.
• Uploaded contracts are stored encrypted and readable only by the reviewer assigned to your account. Delete the contract and the extracted clause goes with it.
• Backups are taken daily and restores are tested; a restore that has never been tested is a hope.

02 Who can see it

• Reviewers see only the accounts assigned to them, and every view is logged.
• Administrative access requires a hardware key.
• Access is reviewed when anyone joins or leaves, and revoked the same day.

03 The application

• Google sign-in only. We never store a password, so we cannot leak one.
• API keys are scoped to a workspace, shown once, and revocable immediately.
• Webhooks are signed with HMAC-SHA256 and carry a timestamp to prevent replay.
• Dependencies are minimal by design: no framework, no package manager in the web path.

04 The evidence ledger

Every check, change and decision is appended to a hash-chained ledger, each row carrying the hash of the row before it. An entry cannot be altered or back-dated without breaking every row that follows, and verification is public — you do not need our cooperation to check us.

05 What we have not done

• No SOC 2 or ISO 27001 yet. We will not imply otherwise, and we will not describe ourselves as “SOC 2 aligned”, which means nothing.
• No independent penetration test yet. Planned before general availability, and we will publish the summary.
• No bug bounty yet — but we will respond to disclosures properly and credit you.

06 Reporting something

Email [email protected]. We reply within two working days, we will not threaten you, and we will credit you unless you ask us not to. Please do not test against other people’s accounts or the register data of companies who did not ask to be involved.