Trust & security
Security at Custonic
Custonic processes sensitive commercial agreements. We treat that responsibility with the same rigor we ask our customers to bring to their contracts. Security is not a feature — it's the architectural foundation.
Data locations and processors
Persistent account data, uploaded contracts, findings and settings are stored in the configured Supabase EU project in Stockholm. Application functions are configured for Vercel Frankfurt, Vercel Workflow data is stored in iad1, and AI analysis follows Anthropic's commercial terms. The full service is not represented as EU-only processing.
The Supabase project is verified in eu-north-1 (Stockholm), and application functions are pinned to Vercel fra1. Provider DPAs, subprocessors and documented failover remain part of each customer's assessment.
Vercel Workflow stores its event log and queue data in iad1. Workflow inputs and results are encrypted; operational metadata such as workflow and step names, entity IDs, timestamps and lifecycle states is not encrypted. Custonic sends only organization, contract and internal job identifiers, locale, and analysis IDs or status through this layer—not contract text, findings or summaries.
Contract content is sent to Anthropic for analysis under its commercial API terms. Inputs and outputs are not used for model training by default; standard API data may be retained for up to 30 days, while zero data retention applies only where separately approved and contracted.
Encryption at every layer
Supabase and Vercel provide encryption in transit and at rest under their platform controls. Contract access is additionally constrained by PostgreSQL row-level security policies.
Transport and storage encryption are provider-managed controls. Vercel Workflow encrypts user payloads in its event log, but operational metadata remains visible to the platform; Custonic does not describe database connections as end-to-end encrypted or guarantee a specific TLS version without runtime evidence.
File hashes (SHA-256) are computed on upload for integrity verification and duplicate detection, helping us confirm that the document analyzed is the document you submitted.
Security controls are layered: transport, storage, database access, and application safeguards reinforce each other rather than relying on a single perimeter.
Your data is never used for AI training
Anthropic does not use commercial API inputs or outputs for model training by default. Retention and deletion follow the configured commercial terms: standard deletion is within 30 days, while zero data retention requires a separately approved agreement.
Custonic sends contract content to Anthropic's Claude API for analysis. The commercial API's default policy excludes model training and permits limited retention for safety and abuse monitoring.
Structured results are stored in your Custonic account. Anthropic retention follows the terms configured for Custonic; we do not claim zero retention unless that agreement is active.
That means your agreements remain yours: processed for insight, not absorbed into a general-purpose model.
Row-level tenant isolation
Multi-tenant architecture with database-level isolation. PostgreSQL RLS policies are designed to prevent one organization from accessing another organization's contracts, adding a database-level control alongside application authorization.
Every database table with organization-scoped data has PostgreSQL Row Level Security (RLS) policies that enforce strict tenant isolation.
Even if application code were to contain a bug, the database itself prevents cross-organization data access. That is defense in depth: application filtering and database enforcement working together.
For B2B customers, this matters because the most important security control is not only who can log in — it is what they can never see.
Documented audit events
Custonic records supported security and product events with available actor, action, time and resource context. Coverage is documented and is not represented as a complete SOC 2 audit trail.
Supported events include contract uploads, analysis runs, team member changes, settings modifications and data exports. Coverage and fields depend on the event source.
Event fields vary by event source. IP address and other request metadata are recorded only where the implementation supplies them.
These controls can support assurance work, but Custonic does not claim SOC 2 certification or audit readiness.
Privacy-supporting controls
Controls support access, rectification, erasure, and portability requests. The current product uses essential authentication cookies and does not claim an active third-party analytics deployment.
Custonic is built to support data subject rights: access, rectification, erasure, and portability. Privacy obligations are treated as product requirements, not documentation tasks.
Cookie usage is minimal and limited to authentication and session management. There are no third-party advertising cookies and no cross-site tracking layer hidden behind a consent banner.
Our privacy policy is available in all supported languages. Customers should request and review the current contractual privacy and subprocessor terms before relying on them.
Questions about security? Contact security@custonic.com
Security-first by design
Start monitoring contracts with the security posture they deserve
Disclosed data locations, tenant isolation, and explainable contract analysis — built in from day one.