Your contracts are confidential. We built ContractIQ that way.

01Hosting and data location

• The database runs on Supabase’s managed PostgreSQL platform in AWS eu-west-1, Ireland.
• Documents are kept in a private storage bucket in the same region. The bucket is not public and is reached only by our servers.
• The application runs on Vercel, with server compute in its Dublin region.
• Backups of the database are managed by the hosting provider according to its plan.

02Organisation isolation

• Every organisation’s records are separated inside PostgreSQL by row-level security, enabled and forced on every table.
• The application connects with a dedicated, least-privilege database role that cannot bypass those policies, create roles or alter the schema.
• The organisation a request acts on is derived from the signed-in person’s live memberships — never taken from the browser — and checked again by the database.
• Records reference each other with keys that include the organisation, so a record can structurally never point at another organisation’s data.

03Authentication and sessions

• Accounts are local to ContractIQ. Passwords are hashed with bcrypt; we never store or log the password itself.
• Sign-in attempts are rate limited, and repeated failures lock the account for a period.
• Session tokens are random, stored only as HMAC hashes, and held in the browser in httpOnly cookies that page scripts cannot read.
• Sessions expire after inactivity and after a fixed lifetime, and people can sign out other sessions.

04Roles and permissions

• Roles are made of named capabilities, such as viewing restricted contracts or managing approvals.
• Capabilities are checked on the server for every page and action, and again by the database for every query. Hiding a button is never the only control.
• A permission removed from someone takes effect on their next request.
• Restricted contracts are visible only to their owner, the people working on them and those allowed to see restricted contracts.

05Documents

• Uploads are checked against their actual content, not only their file name, before they are accepted.
• Files are opened through signed links that expire after one minute and are issued only after the database confirms you may see the document.
• Every revision is kept as a version; replacing a file never overwrites the previous one.

06Audit and transport

• Changes are written to an append-only audit log in the same database transaction as the change itself. The log records which fields changed, not their confidential values.
• All traffic is served over HTTPS, with HTTP Strict Transport Security so browsers refuse unencrypted connections.

07Your data

• Your organisation can export its contract portfolio at any time.
• We do not process your contracts or documents with AI services, and we do not use them to train models.
• We do not sell your data.
• The website and application use only essential cookies for signing in and remembering your organisation. There are no tracking or advertising cookies.
• Running the service does not mean reading your agreements: Techvora’s operator tools show organisation-level information such as member counts and storage used, not contract records or documents.

08Reporting a vulnerability