CONTRACT SECURITY. CLEARLY EXPLAINED.
Keep access intentional, decisions traceable, and the source close at hand. Explore the protections built into your contract workspace.
Security overview · Updated November 1, 2026
PROTECTION THROUGHOUT THE WORK
Workspace membership and roles control access to records and actions. Server-side checks enforce permissions when people open documents or make changes.
ContraxAware uses Cloudflare R2 for document storage and D1 for application records. These services encrypt stored data, and the app is delivered over HTTPS.
Give reviewers access to the selected document and choose the participation they need. External review is scoped to the saved review copy.
Use the available Google, ChatGPT, or email and password sign-in options. Password credentials are stored as salted hashes; browser sessions use protected cookies.
Recorded contract changes and workflow events provide context about what happened and who acted. Saved document versions keep earlier wording available for comparison.
Extracted values and AI findings are proposals to check against the agreement. Source links and quoted passages help people inspect the basis for an answer.
Google integrations require authorization for the connected account. Selected imports and supported exports keep the connection tied to an explicit task.
Draft editing, review, approval, and signing are separate steps. Reviewers can check proposed wording and saved versions before an agreement moves onward.
KNOW WHAT YOU ARE RELYING ON
Requirements differ between organizations. Confirm the controls you need before uploading sensitive or regulated information.
We do not currently claim an independent SOC 2 report or ISO 27001 certification for ContraxAware. A hosting provider’s certifications do not certify our application.
Company-managed SAML/OIDC SSO is not currently advertised as an available control. Available third-party sign-in can use the protections configured for that provider account; this is not an app-wide MFA enforcement claim. Contact us about your organization’s requirements.
No. This overview describes product controls, not a regulatory certification or a guarantee that your use meets a particular requirement. Contact us to discuss the applicable terms, data handling, and evidence your organization needs.
AI features process contract content to provide the requested analysis. We are not making a blanket model-training, zero-retention, or data-residency promise here. Ask us to confirm the applicable AI provider terms and retention arrangements for your requirements before uploading sensitive content.
Activity history covers supported recorded changes and workflow events. It is not a claim that every read, download, or user action is logged, or that the record is immutable.
This page does not promise customer-selected data residency, a specific backup schedule, recovery time, or uptime SLA. Contact us to confirm current arrangements against your procurement requirements.
Email john.damelio@contraxaware.com with the subject “Security inquiry” or “Security concern.” Describe the affected area without sending passwords, access tokens, or confidential contract text. We can discuss a suitable way to share supporting details.
Cloudflare documents the encryption properties of the storage services used by ContraxAware. These references describe the underlying services.
R2 data security ↗D1 data security ↗LET’S TALK THROUGH YOUR REQUIREMENTS
Ask about access, data handling, or a control your organization needs.
Request a Demo Contact us about security ↗