Security Controls
Enterprise-facing overview of ContractRabbit cloud security, access control, encryption, monitoring, and development practices.
Cloud architecture
ContractRabbit runs on a cloud architecture designed to process confidential contract documents while preserving operational reliability and tenant separation. Core data services include:
| Layer | Purpose | Customer data involved |
|---|---|---|
| Object storage | Uploaded documents, generated documents, document versions, and other unstructured artifacts. | Contract files, generated versions, extracted text, and derived document artifacts. |
| PostgreSQL | Structured application records, metadata, tenant relationships, workflow state, audit records, and extracted contract data. | Customer workspace records, document metadata, extraction results, lifecycle data, and audit history. |
| Redis | Caching, session-related workflows, queues, and high-performance transient data. | Transient application state, cache entries, and workflow coordination data. |
| Search and derived indexes | Fast retrieval, classification, analytics, and AI-assisted review workflows where configured. | Searchable text, metadata, embeddings, and derived records required to provide the service. |
Enterprise architecture details, deployment boundaries, residency requirements, and isolation requirements may vary by agreement.
Encryption
ContractRabbit encrypts customer data at rest and in transit.
| Control area | Approach |
|---|---|
| Data at rest | Persistent data stores use AES-256 or managed-service equivalent encryption for stored records, documents, cache persistence, and search indexes. |
| Data in transit | Client, API, and service communications use TLS. Browser and API traffic support TLS 1.2 and TLS 1.3 where applicable. |
| API access | API communications are sent over encrypted HTTPS connections and authenticated using supported session or API key mechanisms. |
Tenant isolation
ContractRabbit is a multi-tenant platform. Tenant boundaries are enforced through application authorization, tenant-scoped data access, and repository-level data access patterns. Standard deployments use logical separation on shared infrastructure.
| Isolation layer | Standard control | Enterprise options |
|---|---|---|
| Application authorization | Requests are evaluated against the authenticated user's workspace and tenant context. | Customer-specific authorization rules or identity provider requirements. |
| Data access | Application data access is tenant-scoped and designed to prevent cross-tenant access. | Dedicated database, dedicated storage, or separate deployment boundary where contracted. |
| Object storage | Document artifacts are organized by tenant and document identifiers. | Dedicated bucket, region-specific bucket, customer-managed keys, or separate cloud account where contracted. |
| Operations | Administrative access is restricted to authorized personnel and operational need. | Named support personnel, enhanced approval workflows, or customer notification requirements. |
Enterprise customers may define additional isolation, deployment, retention, support, or infrastructure requirements in the applicable contract.
Access control
Production access is governed using least-privilege and role-based access control principles.
| Control | Standard posture |
|---|---|
| Administrative access | Restricted to authorized personnel with a business or operational need. |
| Least privilege | Permissions are assigned by role and reviewed as responsibilities change. |
| MFA | Multi-factor authentication is required for administrative access. |
| Production data access | Access is logged and limited to support, security, or operational purposes. |
| Approval controls | Sensitive administrative operations use approval controls, including dual authorization where required. |
| Customer identity | Enterprise identity provider integration, including SSO/SAML, may be supported for customer-facing authentication workflows. |
Secure development lifecycle
ContractRabbit uses a multi-stage development and deployment process:
- Development and local validation.
- Automated tests for new and changed functionality.
- Static code analysis and dependency vulnerability checks.
- Preview environment validation before production release.
- Peer code review and approval.
- Staged production rollout using feature flags where appropriate.
Security review, performance testing, and regression validation are incorporated before production deployment for material platform changes.
Network and infrastructure security
ContractRabbit uses network controls to reduce unnecessary exposure between services and external entry points.
- Application endpoints are protected by web application firewall controls where configured.
- Firewall and security group rules restrict unnecessary access.
- Infrastructure access is reviewed and updated as systems evolve.
- Administrative access is protected by identity and authentication controls.
Monitoring and incident response
Security-relevant platform activity is logged and monitored. ContractRabbit maintains incident response procedures for investigating, escalating, and communicating security events.
| Practice | Description |
|---|---|
| Event monitoring | Security-relevant activity is monitored and escalated based on severity. |
| Audit logging | System, user, and administrative activity is logged where supported. |
| Investigation workflow | Security events are triaged, investigated, contained, and remediated according to internal procedures. |
| Customer communication | Material security events are communicated according to the applicable agreement and notice requirements. |
Customer-specific notice requirements, contacts, and response timelines are governed by the applicable agreement.
Compliance alignment
ContractRabbit's controls are designed to align with commonly requested enterprise security frameworks and vendor risk review expectations, including:
- SOC 2 control alignment and evidence collection for a future Type I audit.
- ISO 27001 security management principles.
- NIST Cybersecurity Framework practices.
SOC 2 references describe ContractRabbit's control alignment and audit-readiness work. ContractRabbit does not represent SOC 2 certification or an active audit as complete until the applicable audit is completed and the report is available.
Business continuity and recovery
ContractRabbit maintains backup and recovery processes for critical data stores.
- Critical data is backed up on an automated schedule.
- Point-in-time recovery is available for supported data stores.
- Disaster recovery procedures are reviewed and tested periodically.
- Recovery objectives and customer-specific commitments are governed by contract.