Your contracts contain sensitive business information.
Security you can trust.
Here is exactly how we protect them.
Encryption
At rest: All data is secured using Fernet symmetric encryption (AES-128-CBC). Documents are never stored in plain text.
In transit: All uploads, downloads, and app data traverse over TLS (HTTPS) connections exclusively.
Access Control
Role-based access: Strict separation of duties via Admin, Contract Owner, User, and Professional Guest roles. Access can be scoped by department.
Authentication: Strong password requirements (hashed, never stored plain text). Automatic lockout after 5 failed attempts (15-min cooldown) and rate limiting on auth endpoints.
Two-Factor Authentication: Support for TOTP authenticator apps and SMS codes, plus backup recovery codes.
Session security: HTTPOnly + Secure cookies. Sessions automatically expire after 30 minutes of inactivity with a 5-minute warning. Options to "log out all sessions".
Guest Controls: Professional Guests get time-limited, read-only access scoped strictly to specific departments, with full audit logging.
Audit & Accountability
Comprehensive trail: Every view, upload, edit, download, deletion, and email send/open is logged with user identity, timestamp, and IP address.
Login history: Users can view their last 20 login events (device/browser/OS, with privacy-masked IP). Admins can view org-wide activity and terminate sessions.
Multi-tenant isolation: Org-scoped queries, per-endpoint authorization checks, and department isolation ensure data never crosses boundaries.
Infrastructure
Headers: Strict application of standard security headers (CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy).
Rate limiting: Endpoint protection to prevent abuse and denial of service.
Responsible AI & Data
No model training: AI analysis is powered by Google Gemini on Google Cloud's Vertex AI. Your data is never used to train generic AI models. Google Cloud states that data processed by Vertex AI is not used to train or fine-tune any AI/ML models.
Grounding: Responses are grounded exclusively in your uploaded contracts and the context you configure.
Data control: You control your data. Choose to archive records or permanently delete them. See our Privacy Policy for details on data retention and deletion rights.
Watermarking: Document downloads and prints are automatically watermarked with user identity and timestamp.
Communications: Direct email via SendGrid with read receipts; all email activity is logged in the audit trail.
Have security questions? Contact us at security@accordable.ai