Storage options
Two ways to hold your documents, and what each one costs you
Termsroom holds the record of a negotiation and not the agreements. Where the agreements live is your choice, and the two paths do not carry the same custody position. This page sets them side by side.
The short version
On the SharePoint path, Termsroom holds no credential into your tenant. Access is a token your own tenant issues at the moment it is needed, scoped by your administrator to one site, and revocable by them without contacting us.
On the bring your own storage path, Termsroom does hold a credential. You create an access key in your own console and hand it over; we encrypt the secret half of it on arrival and use it to read and write your bucket. That is a real difference and it is the reason this page exists rather than a paragraph saying we never hold anything.
Some organisations do not treat consumer-grade file sync as enterprise storage, and will not put a contract archive in one whatever the tenant type says. The API key path exists for them: a bucket with versioning, object lock if they want it, their own retention schedule and their own encryption keys, connected without a directory in the middle.
Side by side
SharePoint or OneDrive for Business
availableno credential held- What Termsroom holds
- Tenant id, site id, drive id, folder name, and the validation report. No credential of any kind.
- How organisational status is proved
- A directory lookup. A personal Microsoft account cannot produce an organisation profile, and a consumer OneDrive reports its drive type as personal, so the answer comes from Microsoft rather than from a box the user ticked. The drive type is recorded either way, so the connection says whether it is a site library or a personal drive inside your tenant.
- What happens on revocation
- Your administrator deletes the Sites.Selected grant on the site. Access stops immediately and needs no contact with us. There is no credential left over on our side, because there never was one.
- What a security reviewer should check
- The consent screen. Termsroom requests User.Read and Sites.Read.All delegated, and Sites.Selected as an application permission, and never requests offline_access, so Microsoft issues no refresh token.
A SharePoint site library and a OneDrive for Business drive are both accepted, and they are not the same thing. A site library is owned by the institution. A OneDrive for Business drive belongs to one person, so a bargaining record placed there follows their retention and sharing and goes with them when they leave. Termsroom accepts either, names which one you connected on the connection itself, and recommends a site library for a record both parties may need years from now. A consumer OneDrive is refused: Microsoft reports it as a personal drive and the product will not take it.
S3 compatible bucket, your keys
availablewe hold a credential- What Termsroom holds
- Endpoint, region, bucket, prefix, access key id, the validation report, and a vault reference to the secret access key. The secret itself is readable only by the service role.
- How organisational status is proved
- An attestation by your administrator, supported by two checks we can run: the bucket is not readable by the public, and it keeps versions. A bucket has no directory behind it, so this is weaker evidence than the Microsoft path and the connection record says so.
- What happens on revocation
- You delete or rotate the key in your own console. Access stops at once. Disconnecting in Termsroom retires the connection; ask us to purge the vault entry and we will, but rotating the key is what actually ends access and it does not need us.
- What a security reviewer should check
- The IAM policy attached to the key you issue. Termsroom needs get, put and multipart on one prefix and read on the bucket configuration. It has no reason to hold list, delete or policy rights across the bucket, so do not grant them.
Google Drive
availablewe hold a credential- What Termsroom holds
- The folder id and name, the Google account and Workspace domain that connected it, the validation report, and a reference to the refresh token in the vault. Never the documents.
- How organisational status is proved
- Google’s own answer. The sign-in carries a hosted domain only for a Google Workspace account, so a consumer Gmail account cannot pass as organisational, whatever the person ticks. It is accepted only for an organisation with no annual plan, marked as personal, and the database refuses to put a bargaining document in it. Termsroom then writes a test file into the folder, reads it back and compares the fingerprint before the connection is accepted.
- What happens on revocation
- Disconnect it on the storage page, which deletes the refresh token from the vault, or remove Termsroom at myaccount.google.com/permissions, which stops it working at once. A Workspace administrator can also remove the app for the whole domain.
- What a security reviewer should check
- The consent screen. Termsroom requests openid, email, profile and drive.file, the scope that limits it to files it created. It does not request access to the rest of the Drive.
A Google Workspace account is required. The folder is created in the Drive of the person who connects it, so a bargaining record there follows their account; for a record both parties may need years from now, move the folder into a shared drive, which Termsroom follows. A personal Gmail account is refused for annual bargaining plans, on Google’s own report that it has no Workspace domain. An organisation that buys deals instead may use one, for its deals only.
What is the same on both paths
Termsroom stores no document bytes and no clause text on either path. Depending on the comparison, it either reads the text of the versions in server memory or works from the clause index already on record. Either way, only the findings are kept, never the text. What it holds is pointers, hashes, clause structure, findings and the audit trail. For annual plans, personal accounts are refused rather than warned about, the refusal is recorded, and a connection cannot be made active without a validation report behind it. For deals, a personal Google Drive or OneDrive is accepted, recorded as personal, and the database refuses to put a bargaining document in it.
Both paths write into a folder or prefix of your choosing, so Termsroom material is never mixed with your own. Both keep every version. Both leave you holding a complete copy of everything you were entitled to see, whether or not you are still a customer.
The full custody position, including the queries you can run against your own data, is on the trust page, and the questions people ask before buying are on the questions page.
Both paths also record a fingerprint of every version, which is how either side confirms that the copy it holds is the one that was agreed, on whichever provider it sits. That is explained on the document integrity page.
A question? Talk to us.
Buying, a security review, a purchase order, or a question about your own situation: write to us and a person on the team will reply.