Security
Security & Data Handling
How Cessions handles your documents during private preview, and what is on the enterprise roadmap.
Where we are today
Cessions is in private preview. We are building toward enterprise security expectations — auditability, access controls, tenant isolation, and future compliance readiness. This page describes what is in place now and what is planned. We do not claim certifications we do not hold. If your security team has questions this page does not answer, we will answer them directly and in writing during pilot scoping.
In place today
Tenant isolation
AvailableEvery organization’s data is isolated at the database layer using row-level security policies. Server-side routes independently verify organization membership before any read or write — defense in depth, not a single control.
Source documents are read-only
AvailableUploaded treaty documents are never modified by Cessions. AI-proposed revisions are applied only to generated work product, never to the source file.
Human review is architectural
AvailableEvery AI-extracted finding lands in a review queue with status needs_review. A qualified reviewer must explicitly accept or reject it. Generated documents mark unreviewed findings as pending review.
Full audit trail
AvailableEvery review action — who, when, what changed, what note was recorded — is written to an append-only audit log with the reviewer identity and timestamp. Exportable as CSV for compliance review.
Source-cited outputs
AvailableEvery finding carries a verbatim quote from the source document and its location. Citations are validated against the source text and checked for scope and polarity by a second verification pass.
Encryption in transit and at rest
AvailableAll traffic uses TLS. Documents and database records are encrypted at rest by the underlying platform providers.
Role-based access control
AvailableOrganization roles (owner, admin, reviewer, member) are enforced server-side. Only owners and admins can invite members, change roles, or access the admin console.
Controlled document upload
AvailableDocuments enter Cessions only through explicit user upload. Cessions does not connect to, crawl, or sync from customer systems during private preview.
Enterprise readiness roadmap
These items are planned. None are currently certified, enabled, or generally available.
SOC 2 Type II
RoadmapA SOC 2 audit is planned. Internal readiness work — policy inventory, evidence collection, access control review, incident response planning — is underway. We will publish the report only once an audit is complete.
ISO 27001
PlannedISO 27001 is a future enterprise compliance consideration, sequenced after SOC 2.
SAML 2.0 / OIDC single sign-on
Enterprise PilotTrue SSO integration with Okta, Entra ID, and other identity providers can be discussed and configured during enterprise pilot onboarding. Okta Bookmark Tile access is available now — note that a bookmark tile is not SSO.
SCIM provisioning
RoadmapAutomated user provisioning and deprovisioning from your identity provider. Currently, pilot users are provisioned manually by an organization admin.
Customer-managed storage
PlannedBring-your-own storage bucket so documents never leave your cloud tenancy. Under evaluation for enterprise pilots.
Configurable data retention
RoadmapPer-organization retention policies and scheduled deletion. Currently, data is retained for the duration of the pilot and deleted on request.
Document repository connectors
RoadmapSharePoint, OneDrive, Box, and S3 connectors are on the roadmap and will be prioritized by customer requirements. Cessions currently supports controlled manual upload only.
Public REST API
RoadmapProgrammatic access is planned. It will not be released until authentication, permissions, rate limiting, and audit logging are production-ready.
What Cessions does not do
- ✕Cessions does not produce final treaty language, binding contract terms, or executed documents.
- ✕Cessions does not provide legal advice, actuarial opinions, or underwriting decisions.
- ✕Cessions does not replace attorneys, underwriters, brokers, treaty analysts, or compliance teams.
- ✕Cessions does not modify your source documents. They remain read-only.
- ✕Cessions does not connect to, crawl, or sync from your internal systems during private preview.
- ✕Cessions does not train models on your documents.
- ✕Cessions does not share your data across organizations. Tenant isolation is enforced at the database layer.
AI processing
Cessions uses Anthropic's Claude models via API for extraction, verification, comparison, question answering, and document generation. Document text is transmitted to the model provider for processing and results are returned to Cessions. Extraction is retrieval-grounded: the model receives only the document spans relevant to a given extraction category, not the entire document, and is constrained to generate findings only from those spans.
A second verification pass independently checks every claim against its cited span for scope match, polarity match, and omitted qualifiers. Findings that fail verification are surfaced to the reviewer with the flag visible — they are not suppressed.
Read the full methodology in our working paper.
Security questions?
We will answer security and data handling questions from your team directly and in writing during pilot scoping. No question is too detailed.
Contact us about securitySOC 2 Readiness
RoadmapCessions is building toward a SOC 2 Type I report, and later Type II, across the five Trust Services Criteria. We are not currently SOC 2 certified — no vendor may claim certification without an issued auditor report, and we will update this page the moment that changes. What follows is our real, in-progress control program.
Security
Protection against unauthorized access, physical and logical.
Availability
System availability as committed or agreed.
Processing Integrity
Complete, valid, accurate, timely, authorized processing.
Confidentiality
Confidential information protected as committed.
Privacy
Personal information handled per stated commitments.
Our internal control tracker covers 20 areas including MFA and account security, role-based access control, least privilege, production and document access logging, encryption in transit and at rest, secure SDLC and code review, vulnerability management, backup and recovery, incident response, vendor management, data retention, customer data segregation, and AI-specific controls including generated output auditability and human review enforcement.