Security & Data Handling

The browser has no direct database access — every business table is server-only. Server routes authorize tenant, capability, and record scope on every read and write, and cross-tenant access returns not-found before any data is read. Row-level security remains as defense in depth.

Uploaded treaty documents are never modified by Cessions. AI-proposed revisions are applied only to generated work product, never to the source file.

Every AI-extracted finding lands in a review queue with status needs_review. A qualified reviewer must explicitly accept or reject it. Generated documents mark unreviewed findings as pending review.

Every review action — who, when, what changed, what note was recorded — is written to an append-only audit log with the reviewer identity and timestamp. Exportable as CSV for compliance review.

Every finding carries a verbatim quote from the source document and its location. Citations are validated against the source text and checked for scope and polarity by a second verification pass.

All traffic uses TLS. Documents and database records are encrypted at rest by the underlying platform providers.

Access is enforced by a fine-grained capability + scope model, server-side. Ten built-in roles separate governance (identity, access, configuration) from operational work. A user can be scoped to specific renewals so they never see or touch another program’s records.

Every business table is server-only — the browser has zero direct database access. All reads and writes flow through a server that enforces the caller’s capability and scope, and cross-tenant access returns not-found before any data is read.

Organization-wide actions (user administration, whole-org audit export, role assignment) require organization-wide authority — a role scoped to a single renewal can never perform them. Privileged role assignment requires elevated authority and is audit-logged.

HTTP security headers (HSTS, clickjacking protection, content-type and referrer policy), distributed rate limiting on the public request-access endpoint and on abuse-sensitive authenticated endpoints, and a central upload pipeline that validates file type, size, and actual file content before a document is trusted.

Documents enter Cessions through explicit user upload during private preview, and are only trusted after a server-side validation/finalize step. Data-source connectors (SharePoint/OneDrive, Google Drive, Snowflake) are in limited preview, configured per engagement. They use read-only provider scopes, further narrowed by approved-source configuration and application-level authorization — the connector never has broader access than the specific approved sources.

A SOC 2 audit is planned. Internal readiness work — policy inventory, evidence collection, access control review, incident response planning — is underway. We will publish the report only once an audit is complete.

ISO 27001 is a future enterprise compliance consideration, sequenced after SOC 2.

True SSO integration with Okta, Entra ID, and other identity providers can be discussed and configured during enterprise pilot onboarding. Okta Bookmark Tile access is available now — note that a bookmark tile is not SSO.

Automated user provisioning and deprovisioning from your identity provider. Currently, pilot users are provisioned manually by an organization admin.

Bring-your-own storage bucket so documents never leave your cloud tenancy. Under evaluation for enterprise pilots.

Per-organization retention policies and scheduled deletion. Currently, data is retained for the duration of the pilot and deleted on request.

SharePoint/OneDrive, Google Drive, and Snowflake connectors are in limited preview today (read-only, approved-source scoped). Box and S3 connectors are on the roadmap and will be prioritized by customer requirements.

Programmatic access is planned. It will not be released until authentication, permissions, rate limiting, and audit logging are production-ready.