Ask us the hard ones.

At the database, not in application code. Roughly 200 customer tables carry your organization ID on every row, and Postgres row-level security policies enforce the boundary on every query. A session from your organization physically cannot return another organization's rows, even if there were a bug in the application layer. Storage policies on the file buckets mirror the same organization rule. This is the control everything else stands on.

The database still refuses the rows. Row-level security runs inside Postgres, below the application, so a cross-tenant read attempt returns a row-level denial from the database, not an application error a bug could route around. You can reproduce this yourself in a trial: create two organizations, upload to one, and watch the other organization's session get denied at the API.

24 automated cross-tenant isolation test suites run in CI on every change. The failing cross-org read is a permanent regression test, not a one-time demo, and we demonstrate it live in security reviews on request.

Yes, and we say so plainly: this is a multitenant Postgres database, not a database per tenant. The boundary is enforced by the database engine through row-level security on every one of roughly 200 customer tables, and re-proven by 24 CI isolation suites on every change. What you get is a boundary that is tested continuously rather than assumed per instance.

Yes. Contract files live in private storage buckets whose policies mirror the organization rule from the database. There is no public URL to any customer file, ever, and access outside your organization is refused even with a direct storage path.

App-based TOTP, with session step-up enforcement for sensitive actions. Organization owners can enforce MFA org-wide by policy, and MFA is mandatory for every member of VendorBenchmark staff. Passkeys and WebAuthn are not built yet; TOTP is the second factor today.

SAML and OIDC SSO per organization. The Require SSO switch is a real enforcement: once it is on, password and magic-link sign-in are refused for your domain. Organization owners keep a break-glass path so a broken identity provider cannot lock the tenant out.

SCIM 2.0, working today with Okta, Microsoft Entra, and any SCIM-capable identity provider: provision, list, and deactivate from your directory. Offboarding in your directory is offboarding here. SCIM tokens are stored as SHA-256 hashes and expire within one year.

Twelve characters minimum, and every new password is screened against known breach corpora before acceptance, using a privacy-preserving k-anonymity range query in the style of Have I Been Pwned, so the password itself never leaves our server. Under Require SSO, password sign-in is refused entirely for your domain.

Users see every active session under Settings, can revoke any single one, or sign out everywhere else with one action. A sign-in from a new device emails the account owner. New this month, organization owners can also set a session policy under Settings: a maximum session age and an idle timeout, so your own limits apply to every member.

Yes, new this month: organization owners can set an IP allowlist in CIDR notation under Settings, so sessions outside your listed ranges are refused for your organization.

Owner and member roles per organization, managed by your own organization owners. Sensitive actions, member management, data export, retention, and deletion among them, are owner-only. Below the role layer, individual contracts can be restricted to named people within your organization, so need-to-know applies inside the tenant boundary too.

No. Platform admin rights live in a separate table that no customer-facing code path can write to. There is no privilege-escalation route from a customer account, and admin status cannot be self-assigned.

Both are stored as SHA-256 hashes: we can verify them, nobody can read them back, including us. Both expire within one year, so a forgotten credential ages out on its own. API key management is owner-only.

Three checks before anything else touches it: document types only, a 40 MB cap, and a check of the file's actual byte signature rather than its extension, so a renamed executable is rejected even if it claims to be a PDF. The upload is then written to a private bucket under your organization's path and recorded in the audit trail.

Every download uses a signed URL minted per authorized request, expiring after roughly 60 seconds, and never pre-signed into HTML. A leaked link or a saved page is dead before it can be abused. There are no public or long-lived links to any customer file, and every download lands in the audit log.

As long as you need the service, and no longer. Organization owners set a retention policy under Settings, Data controls, and the same screen shows the whole lifecycle: collected, isolated, retained on your policy, deleted on request.

The database rows and the stored files are both removed. Deletion is a data path built into the product, not a support ticket. New this month, every contract deletion also writes a durable, timestamped deletion certificate your organization can download and keep for its own records.

Every storage bucket belonging to the organization is swept along with the database rows, and the deletion writes the same durable, timestamped certificate. Nothing waits in a queue for a human to action.

Yes. Organization owners export the organization's data from the data controls screen without a support ticket, and the export includes the file bytes through 1-hour signed links, not just the rows that describe them. The audit log has its own full CSV export.

Export, then deletion, in that order and on your initiative: owners pull the complete export including files, request full deletion, and the rows and files are removed with a deletion certificate to prove it. Your data does not linger because leaving was inconvenient to us.

Only when a member of your organization triggers an AI feature. There is no background training job or batch process reading your documents. Nothing leaves until a user acts.

The specific document text and question needed for that one run go to Anthropic (Claude), our only model provider, called from our servers only and never from the browser. Nothing goes to any other AI vendor, ad network, or analytics service. The result comes back to your tenant and is stored under the same row-level security as the document it came from.

No. Anthropic does not use API data to train models. A contractual zero-data-retention addendum is in progress and has not been signed yet; we say so here and on the security page's claim ladder, and it moves to Implemented only when it is signed.

Every AI run is metered and attributable to the user and organization that ran it, so your admins can see who analyzed what. Outputs are stored in your tenant under the same row-level security as the source data.

Figures in AI-generated reports are grounded in your stored data and citation tagged, and AI reports pass a groundedness check before they reach you. Curated analyst reports are verified by hand. When the assistant cites a clause, the citation points at your actual document.

Anonymized aggregates only, and the pooling is one-way: market low, median, high, and percentile positions come out, but nothing goes in attached to a name. Nothing that could identify your company, your contract, or your specific terms is exposed to another customer.

No. Benchmark output is pooled and anonymized before any other customer sees it. What other customers see is the market shape: ranges and percentiles, never a data point traceable to a company, a contract, or a set of terms.

Never in identifiable form. Your pricing contributes to pooled, anonymized aggregates, and only those aggregates are visible to anyone outside your organization.

Encrypted at rest, scoped to your organization, and used only server-side. No connector credential is ever sent to a browser.

Inbound email and webhooks verify HMAC signatures before anything is processed, and each organization's inbound email addresses carry unguessable capability tokens, so mail sent to yours can only land in your workspace. A forged or misdirected message is dropped, not filed.

Yes. Events we send you are HMAC-signed with timestamps, so your systems can verify us the same way we verify inbound traffic, and replayed payloads are detectable.

Per user, per IP, and per API key, and in production the limiter fails closed: if the rate-limiting backend is unreachable, requests are refused rather than waved through. Authentication, upload, and AI routes carry their own limits.

Actor, action, entity, organization, IP address, and user agent, written for every view, download, create, update, and delete of contract data. Reads are logged, not just writes: a view of a contract file is an audit event.

Identically. Analyst views and downloads of your files flow through the same audit logging as your own members' actions, in the same trail your owners can inspect and export. Staff access is never quiet access.

Yes. Organization owners export the complete audit history as CSV at any time, without a support ticket.

Yes. Subscribe an audit webhook and signed batches of audit events arrive every 15 minutes, cursor-tracked so nothing is skipped and a missed delivery resumes where it left off. Setup lives in the in-app Security Center.

An hourly anomaly detector reads the audit trail and emails your organization owners when one account's downloads, exports, or permission changes look unusual. It runs on our side, so it works even if you never wire up the SIEM stream.

A live posture page inside the app under Settings, Security (the Posture tab): your organization’s MFA coverage, the audit export, and the SIEM webhook setup, on one screen. It exists so your team can verify the claims on these pages against your own tenant instead of taking our word for them.

No customer data breach to date, as of July 2026. The commitment if that ever changes: you hear it from us directly within 72 hours of us confirming an incident that affects your data, followed by a written post-mortem, and the audit trail shows exactly what was touched. Short-lived file links and per-request access bound the blast radius by design.

The application runs on Vercel and the data lives in Supabase, Postgres for records and private buckets for files. Both providers are SOC 2 Type II audited. Every response carries HSTS, nosniff, frame-deny, and a strict Content-Security-Policy with a fresh per-request nonce, and no secret is ever stored in the codebase; keys live in server-side environment variables only.

In the United States, all of it, today. EU data residency is not built; it sits on the Not yet column of the claim ladder rather than in a footnote.

TLS for everything in transit. At rest, the database and storage are encrypted by our infrastructure provider, and the keys are provider-managed. We do not offer customer-managed keys (BYOK) yet, and we say so rather than blurring the line.

Five: Vercel (application hosting), Supabase (Postgres and file storage), Anthropic (AI inference, no training on API data), Resend (transactional email), and Upstash (rate limiting). The current list with roles always lives at /subprocessors; check that page for the authoritative state.

Provider backups are enabled on the database and storage. Honestly stated: our first quarterly restore test is being scheduled, and the results will be published when it runs. Until a restore has been exercised, we count backups as enabled, not as proven, which is why this answer reads the way it does.

SOC 2 Type II controls are implemented and mapped to evidence, evidence collection is underway, and the report will be available under NDA when the auditor issues it. We do not claim SOC 2 until there is a report to show.

GDPR: the DPA is live at /dpa, the subprocessor list at /subprocessors, and deletion is a live product path; the records of processing are being finalized with counsel. CCPA: the privacy notice is live, and we do not sell personal data.

Read the standard DPA at /dpa, it is public rather than gated behind sales. To execute it, email info@vendorbenchmark.com and we complete signature as part of your procurement, on our paper or through your process.

Through the NDA document room: request access at /compliance. Links are token-scoped, access is gated by an NDA click-through, and every open is audit-logged. Inside: the policy set, a pre-completed security questionnaire, and the SOC 2 evidence when it is issued.

Through the responsible disclosure policy, referenced from /.well-known/security.txt. Reports are acknowledged within 3 business days, and good-faith research gets safe harbor. Security is owned by Fredrik Filipsson, founder, reachable at info@vendorbenchmark.com.

We require valid legal process before disclosing customer data, and we notify the affected customer unless we are legally barred from doing so. We do not volunteer customer data, and we interpret requests narrowly.

The analysts who produce your deliverables, for that purpose. Their access runs through the same audited paths as yours: every analyst view and download is logged with the person, the action, the time, the IP, and the user agent, in the trail your owners can inspect and export. MFA is mandatory for every member of our staff.

MFA is mandatory for every staff member, access follows least privilege, and admin actions are logged in the same audit trail as everything else. Platform admin status lives in a separate table that no customer-facing code path can write to, so it is granted deliberately, never inherited or self-assigned.

24 cross-tenant isolation suites run in CI on every change, so an isolation regression cannot ship quietly. Changes go through code review, and no secret is stored in the repository; keys live in server-side environment variables only.

Sharing outside your organization is an explicit action by someone in your organization, never a default. Anything shared externally passes a confidentiality scan for sensitive terms first, and external share links expire on their own.

Not yet. The first engagement is being scheduled, and the report will land in the NDA document room when it is done. Until then, the standing controls are the CI isolation suites and the public disclosure program with safe harbor.

No, and we have not started. SOC 2 Type II comes first; ISO 27001 is sequenced behind it.

Not built. Encryption at rest is provider-managed today. If BYOK is a hard requirement for you, tell us; it is exactly the kind of signal that reorders a roadmap.

Not built. All data is hosted in the US today, and we would rather you plan on that than discover it in a data-flow diagram later.

Not built. TOTP is the second factor today, with step-up enforcement and org-wide policy. Passkeys are on the same honest Not yet list as everything else we have not shipped.