Trust Center
Transparency is the foundation of trust. Here's exactly how Coventract protects your data, secures your contracts, and maintains enterprise-grade reliability.
Checking…
Security Measures
Multi-layered protection at every level
Authentication
Email/password + Google OAuth via Firebase Auth. Optional multi-factor authentication (MFA) for all accounts.
Role-Based Access Control
Granular roles: Freelancer, Small Business, Enterprise, Lawyer, Admin. Resources are scoped per user and team.
Rate Limiting
AI operations limited to 10 requests/min per IP. API routes protected against brute-force via server-side guards.
Audit Logging
Every create, edit, sign, and AI action is immutably recorded with user ID, IP address, and timestamp.
DDoS Protection
Google Cloud infrastructure provides automatic DDoS mitigation and global anycast routing.
Content Security Policy
Strict CSP headers, HSTS enforcement, and X-Frame-Options set to prevent clickjacking and XSS attacks.
Encryption
Your data is encrypted end-to-end
In-Transit Encryption
All traffic is encrypted using TLS 1.3 — the latest standard. No data is transmitted over unencrypted connections.
At-Rest Encryption
Firebase Firestore and Cloud Storage encrypt all data at rest using AES-256 managed by Google Cloud KMS.
Key Management
Encryption keys are managed by Google Cloud Key Management Service (KMS) with automatic rotation policies.
Password Hashing
User passwords are hashed using bcrypt via Firebase Auth — plaintext passwords are never stored.
End-to-End Encrypted Contract Storage
Contract content, signatures, and attachments are encrypted both in transit and at rest using industry-standard AES-256 encryption.
Data Storage
Enterprise-grade infrastructure powered by Google Cloud
Primary Database
Google Firebase Firestore — a globally distributed, serverless NoSQL database with automatic scaling.
File Storage
Firebase Cloud Storage for contract attachments, signatures, and media. Regional redundancy by default.
Automated Backups
Daily automated point-in-time backups retained for 30 days. Export to Google Cloud Storage for audit compliance.
Data Residency
Primary data hosted in Google Cloud us-central1 with global CDN for static assets via Firebase Hosting.
Data Retention
Contract versions retained for up to 20 snapshots per contract. Audit logs retained for 2 years. Accounts deleted on request.
Data Isolation
Multi-tenant data isolation enforced at the database level via Firestore Security Rules — users cannot access other tenants' data.
Compliance
Built to meet enterprise and regulatory standards
GDPR
Data-protection rights for EU and UK residents: access, correction, deletion, objection and portability. Deletion is self-serve in Account Settings; for the rest, contact us.
PDPPL
Designed for Qatar’s Personal Data Privacy Protection Law, with a Data Processing Agreement and data stored in Qatar.
Data residency
Contracts, signatures and uploaded files are stored in the me-central1 (Doha, Qatar) region.
No data sale
We do not sell or share your personal data, and we never use your contract content to train AI models.
Right to Erasure
Users can request full account and data deletion at any time from Account Settings.
Privacy Policy
Comprehensive privacy policy outlining data collection, usage, and rights.
Cookie Policy
Essential cookies keep you signed in. Analytics, marketing and personalisation cookies are optional and are not set unless you accept them.
What we do not do
The limits, stated plainly, so you can judge what you still need
We are not a law firm
Coventract is software. Nothing it produces or suggests is legal advice, and using it does not create a lawyer-client relationship.
No lawyer has reviewed the templates
The 182 contract types and their clauses were drafted as solid starting points, not vetted for your jurisdiction. You can request a review by an independent lawyer through the app.
We do not notarise or attest
Some documents — wills, powers of attorney, property transfers — are usually attested before a notary or the competent authority, and an electronic signature alone may not be enough. Those types say so in the catalogue.
We cannot promise a document will hold up
Whether an agreement is enforceable depends on its terms, the parties and the law where it is used. We give you the audit trail and the tamper seal; we cannot represent you or guarantee an outcome.
Self-serve plans carry no SLA
We publish live uptime below rather than a guaranteed figure. A contractual service level is available on Enterprise terms.
System Uptime & Reliability
Real-time platform health monitoring
Checking…
99.9%
Target SLA
Monthly uptime target
Serverless
Architecture
Firebase + Next.js Edge
Global
CDN Regions
Google Cloud CDN
Status updates every 30 seconds. For incident reports, visit our support page.
Questions about security?
Our team is happy to provide detailed security documentation, conduct security reviews, or sign custom DPAs for enterprise customers.