Security
Contracts are the payload. We built for that.
Conovo processes legal documents and the personal data inside them. The practices below aren't a compliance checklist. They are architectural decisions, most of them enforced by construction rather than by policy.
Tenant isolation is middleware, not discipline
Every query is scoped to the calling workspace by a single enforced layer: routes never see another tenant's row, so there is no code path where one could leak. We drill this: automated cross-tenant probes run against real ids and must all be refused.
The browser never holds a real credential
Your server mints 15-minute session tokens with its secret key; the embedded components only ever see the token. Secret keys are hashed at rest and displayed exactly once, at creation. Admin and session tokens are structurally distinct; neither can pass the other's checks.
Logs cannot contain contract content
Operational logs, the audit trail, and the request inspector store ids, statuses, and metadata. Contract text, resolved field values, and recipient details never appear. This is enforced by construction: the logging paths have no access to content, so a logging bug cannot become a data leak.
The send path is deterministic
No AI model can produce or alter a value in a sent contract. AI proposes structure once, at setup, behind an explicit human confirmation step; send-time resolution, math, and formatting are pure, tested code. For documents with legal weight, we consider this a security property.
Every contract is reproducible, forever
Contracts pin the exact template version and store the exact resolved data used at generation. The executed PDF is copied into our storage at completion. An audit event is written for every mutation: who, what, when.
Signed webhooks, guarded egress
Outbound webhooks and data-connector requests are HMAC-SHA256 signed with a per-account secret and timestamped against replay. Customer-supplied URLs (the only outbound addresses you choose) are validated against private-network and metadata-service targets at registration and again at every send.
Encryption in transit and at rest
All traffic is TLS. Documents and database records are encrypted at rest by our infrastructure providers. Per-environment signing keys mean a staging token can never be replayed against production.
Honest test mode
Test keys mint test sessions: their contracts route to a simulated signing provider, never meter billing, and are visibly badged everywhere. Play traffic cannot forge the record of a real execution; the API refuses to simulate events on live contracts.
Subprocessors
The services that touch your data, and why. We'll notify account owners before adding one.
Documenso
E-signature execution, only for accounts that choose it. Signing runs on your own pages by default, with no third party in the loop.
Stripe
Subscription billing and metered usage
Anthropic
AI analysis, bounded per surface: uploaded document text at template setup (field, formula, binding and review proposals, all human-confirmed); the filled document's text when a signer asks a question about it; record facts when a business requests a drafting suggestion; spreadsheet columns with cell values masked to shape during bulk-send mapping; and a read-only anomaly check over resolved values (sensitive fields redacted) on unattended sends. No model output ever lands in a sent contract, and customer content is not used to train models.
Twilio
SMS delivery of one-time codes for phone-verified signing. Sees the signer phone numbers our customers provide for verification, nothing else.
PostHog
Product analytics. Receives content-free events attributed to the platform account (what happened, how many, which route) and never document content, field values, recipient details, or error messages.
Neon
Managed Postgres (application data)
Railway
API hosting
Vercel
Web and dashboard hosting, and private Blob storage for source documents and generated PDFs (access only through our authenticated API, so documents have no public URLs)
Working with us
DPA, disclosure, and what's next
Our data processing agreement is incorporated by reference for every paid account. SOC 2 Type II is on our roadmap; until then, ask for our current security documentation and we'll walk you through it. Found a vulnerability? Email security@conovo.co and we'll respond within one business day. For everything else, the contact page lists who to write.