How we handle your data.

Encryption

In transit: TLS 1.3 for all traffic. We do not accept HTTP. The marketing site, app, and API endpoints all force HTTPS via HSTS.

At rest:Supabase-hosted Postgres uses AES-256 encryption for the database and file storage. Secrets in our environment (API keys, OAuth tokens) are stored in Vercel's encrypted env-var system, not in source control.

Data handling philosophy

Your contracts and revenue data belong to you. Specifically:

• We never train models on your data. The Claude API calls we make use anthropic-no-train-equivalent settings; your contracts are not used to improve any model.
• You can export your full data history (contracts, schedules, journal entries, workpapers) at any time from inside the app. No lock-in.
• If you delete your account, we hard-delete your data within 30 days and confirm in writing. Anonymized aggregate counts (e.g., “3 organizations had this contract shape”) may survive in analytics.
• The pre-launch waitlist stores only your email + the page you signed up from. That's it. No tracking pixels, no cross-site cookies.

Sub-processors

We use these vendors for production infrastructure. Each is contractually obligated to protect your data and is bound by their own SOC 2 / ISO 27001 controls.

• Vercel — hosting + edge + CDN
• Supabase — Postgres, Auth, file storage
• Resend — transactional email
• Anthropic — Claude API for contract extraction (no training)
• Plausible — privacy-friendly analytics (no cookies)

SOC 2 status

In progress.We're building controls now so that when we engage an auditor (target: Q1 2027 for SOC 2 Type 1), the gap analysis is short. If your enterprise procurement requires a SOC 2 report before signing, email us and we'll share what we can today plus a target timeline.

Reporting a vulnerability

If you find a security issue, please email us before disclosing publicly. We aim to respond within 24 hours. We don't have a paid bug bounty yet, but we send a personal thank-you and (when justified) reasonable compensation.