Security
Project information stays private, controlled and auditable.
ContractingClaims is designed for commercially sensitive project records. This overview explains the controls used to protect accounts, company workspaces, uploaded sources and generated documents.
Account protection
Authentication is handled through Supabase Auth with verified email, password recovery, supported single sign-on and optional multi-factor authentication. Sessions and protected routes are checked on the server before workspace data is returned.
Company data isolation
Workspace records are scoped to an organisation and protected with database row-level security. Role checks are enforced for sensitive actions such as team management, billing, document approval and API access.
Private files and exports
Uploaded sources are private by default. File access uses authorised, short-lived links, and generated outputs remain within the relevant company workspace. File type, size and ownership are validated before processing.
Monitoring and audit records
Important account, workspace, API and administrative actions are recorded for investigation and support. Operational faults are monitored without intentionally placing passwords, secret keys or full document contents in error messages.
Payments and infrastructure
Card information is processed by Stripe and is not stored by ContractingClaims. Production traffic uses encrypted HTTPS connections, and application secrets are kept in protected hosting environment settings rather than browser code.
Your security responsibilities
Use a unique password, enable multi-factor authentication, review team access regularly and revoke API keys that are no longer needed. Do not upload material your organisation is not authorised to process.
Report a concern
Send suspected security issues to support@contractingclaims.com. Do not include passwords, API keys or unnecessary personal data.