Security

Overview

ClauseMinds is built for teams that handle sensitive contracts. We design for strong tenancy boundaries, traceable access, and defense in depth. This page summarizes our security posture at a high level. For how we handle personal data, see our Privacy Policy.

Data isolation and access control

The product is structured around workspaces. Users access contracts, obligations, and settings only within workspaces where they are members, enforced by the application and API layers. Role-based permissions limit administrative actions such as billing, team management, and notification configuration where those features are enabled.

Deployment shape affects where primary data resides: the standard product runs on ClauseMinds-managed infrastructure; managed private deployment uses a dedicated ClauseMinds-operated stack; customer-owned deployment (Enterprise) runs in cloud projects your organization controls, such as your Supabase database and storage together with aligned app hosting.

Encryption and transport

Data in transit is protected using TLS for browser and API traffic. At rest, contract files and database content are encrypted by our storage and database providers. Application-level envelope encryption (AES-256-GCM, with rotatable key identifiers so keys can be rotated without re-encrypting the full data set at once) is available for self-hosted and customer-owned deployments that use local storage.

Credentials for third-party integrations (for example cloud-storage and e-signature connections) are encrypted separately from contract content, so a compromise of one class of data does not expose the other.

Authentication

Authentication is handled by ClauseMinds itself: email and password accounts with hashed credentials, plus OpenID Connect (OIDC) single sign-on for organizations that federate identity to their own provider. There is no third-party identity provider in the login path. We recommend customers enforce strong passwords, use SSO where available, and keep workspace membership least-privilege.

Application security

We apply common secure-development practices, including:

• Scoped authorization checks on sensitive reads and writes.
• Validation of uploads (type, size) to reduce abuse and malicious files.
• Structured logging with a redaction layer that strips secrets, tokens, signed URLs, and extracted contract text from log output.
• Outbound webhook destinations are validated against server-side request forgery (SSRF) when configured and re-validated at delivery time.
• A boot-time production gate checks security-relevant configuration before the application starts serving traffic.
• Dependency maintenance and review of security-relevant changes.

Backups and availability

Database and infrastructure availability and backup practices depend on your deployment (for example managed Postgres and storage from our cloud providers). Enterprise deployments can align retention and recovery objectives in a separate agreement.

AI and language-model data handling

Where AI-assisted features are enabled, contract text is processed by our language-model subprocessor over its business API. Under that provider's API terms, API data is not used to train the provider's models, and ClauseMinds does not use customer data to train models of its own or anyone else's. AI-assisted output inside the product is grounded to quoted source text, so every claim can be checked against the underlying document — and extraction runs rules-first, calling the model only where rules are insufficient.

Data retention and deletion

You can delete contracts — including their files and extracted data — from the product at any time. On account termination we delete or return customer data within 30 days on request, subject to legal retention requirements; backups age out on the storage provider's rotation schedule. The full commitment is in our Data Processing Addendum.

Subprocessors

We publish a named list of every subprocessor, what it does for us, what data it can touch, and where it processes data at clauseminds.com/subprocessors. The list is incorporated into our DPA, with notice and objection rights for material changes.

Your responsibilities

Customers play an important part in security:

• Maintain control of user accounts and remove access when people leave.
• Classify and permission contract data according to internal policy.
• Use supported browsers, keep devices patched, and protect session tokens.
• Report suspected incidents promptly using the contact channel below.

Reporting vulnerabilities

If you believe you have found a security vulnerability in the Service, please contact us with a description and reproduction steps. We ask that you avoid disruptive testing (for example no denial-of-service against production) and give us reasonable time to remediate before public disclosure.

Contact

Security questions or incident reports: use our contact page.