Security and data handling

This page describes how Draft Ally handles your contracts today. It is written to answer the questions a security review asks first. For anything not covered here, write to security@draftally.com.

Where your data lives

The web app runs on Vercel, the API and the live editor on Railway, the database on Neon (PostgreSQL), uploaded documents on Cloudflare R2, and sign-in on Supabase. The app, the API and the database run in US regions. Data is encrypted in transit (TLS) and at rest by those providers. Workspaces share one database and one storage bucket; the application scopes every read and write to your workspace.

AI processing

Draft Ally uses one AI provider: the OpenAI API (GPT-4o and GPT-4.1 models) for analysis, key terms, chat and drafting. Contract text is sent with each request that needs it. OpenAI does not use API data to train its models, and keeps requests for up to 30 days for abuse monitoring before deleting them. We send no user names or email addresses in prompts, and our logs record token counts, not contract text. No other AI provider receives your data.

Access

• Sign in with email and password, or with your Google account.
• Two-step sign-in with an authenticator app, with recovery codes.
• SSO (SAML) and SCIM provisioning on the Enterprise plan.
• Five workspace roles, plus per-contract access levels for people you add to a single contract.
• API keys on the plans that include API access, with rate limits.

Audit log

Shares, exports and downloads, approvals, sign-ins, renames, playbook and template changes, and member and account changes are recorded in your workspace's audit log, which admins can search and export. Accepting or rejecting individual edits is not in the audit log yet. Audit logs are kept for 1 year, or 7 years on the Enterprise plan.

Retention, backups and deletion

• The database can be restored to any point in the last 6 hours; there are no longer-lived database backups.
• Error reports (Sentry) are kept for 30 days.
• Deleting a contract removes its files, its analysis and its editor history from our live systems. Deleting a workspace or an account removes its data. A few copies outlast a deletion for a while (the AI provider's 30-day abuse-monitoring copy, the 6-hour restore window, sent emails, files you sent for e-signature, audit rows); the Privacy Policy lists them.
• Want a copy of your data? Ask support@draftally.com and we send an export within 30 days.

Sub-processors

These companies process customer data on our behalf. We notify customers on our data processing agreement before adding a new one.

• OpenAI (API) — AI analysis, key terms, chat and drafting
• Cloudflare R2 — Document storage
• Neon (PostgreSQL) — Primary database
• Railway — API and live-editor hosting
• Vercel — Web app hosting
• Supabase — Sign-in (account identity only)
• Resend — Transactional email
• DocuSign — E-signature, only when a workspace connects it
• Adobe Sign — E-signature, only when a workspace connects it
• Stripe — Billing (no document content)
• Sentry — Error monitoring (error metadata, 30 days)
• PostHog — Product analytics, only after cookie consent

The DOCX-to-PDF converter is self-hosted on our own Railway services, so documents never leave our infrastructure for conversion.

Reporting a vulnerability

If you believe you have found a security issue in Draft Ally, email security@draftally.com. Please include what you found, the steps to reproduce it, and the affected URL or account. We acknowledge every report within 3 business days and keep you updated until it is resolved.

We will not pursue legal action against good-faith research that avoids privacy violations, data destruction and service disruption, stays within your own accounts, and gives us reasonable time to fix the issue before disclosure. We do not run a paid bug bounty programme.

Certifications

Draft Ally does not yet hold SOC 2 or ISO 27001; a programme is planned. We answer security questionnaires (such as the CAIQ) on request.

Support

Support: support@draftally.com — we reply within one working day (Monday–Friday). See also what Draft Ally does today.