Where we actually stand
Termsroom exists to hold the record of a negotiation between two parties who do not fully trust each other. That only works if neither of them has to take our word for anything. This page says what is certified, what is not yet, and how to check the rest yourself.
Certification status
Termsroom does not yet hold a SOC 2 report. Our Type I audit is scheduled for October 2026 and the Type II observation window runs to January 2027, with the report expected in February 2027. A SOC 2 Type II observation window is a minimum of three months and cannot be backdated, which is why no vendor can produce one faster.
What we can show you today is the controls themselves, running, and the evidence that they are. Everything below is live.
Controls running right now
Checked against the live system when this page loaded at 23:49 UTC. Your own security team can run every one of these against your own data.
No document content stored
OperatingC1.1The database physically cannot hold clause text: the data classification that would permit it is forbidden by a constraint.
Enforced at the schema level and asserted in continuous integration.
check constraint no_document_content on data_inventory (class <> 'content')Row-level security on every table
OperatingCC6.1 · CC6.3Authorisation is enforced by the database, not by the application. There is no query path that bypasses it.
Application never queries user data with the service-role key.
alter table … enable row level security on all 15 tablesAudit log is append-only
OperatingCC7.2Nobody can edit or delete an audit entry: not a user, not an administrator, not us.
Verified by the assurance test suite on every deployment.
before update / before delete triggers raise an exception for every roleTransport and browser hardening
OperatingCC6.6 · CC6.7HSTS with preload, strict referrer policy, content-type and framing protection on every response.
Applied to all routes; Teams frame policy scoped to Microsoft origins only.
next.config.mjs security headers
What we hold, and what we never hold
We hold
- Pointers to where a document sits in your own storage
- SHA-256 hashes proving which bytes were tabled
- Clause position, depth and word counts
- Findings, such as that clause 12.4 changed substantively
- Who did what, when, from where
- Text you typed into Termsroom, such as a risk title
We never hold
- Document bytes, in any table, ever
- Clause text or headings from your agreement
- The plain-language summary, which is written to your storage instead
- Any credential into your tenant
- Decryption keys for your documents
Every column in our database carries a declared classification, and the classification that would permit document content is forbidden by a database constraint. A column added without one fails our build.
Check us yourself
Four queries either party can run against their own data, without our involvement.
What do you hold about us?
select * from tr_custody_manifest(:org)Who has accessed our material?
select * from tr_access_report(:org)Has the other side ever seen our caucus?
select * from tr_cross_party_access(:org) -- must return zero rowsHas the record been altered?
npx tsx lib/audit/verify.ts audit-export.json -- runs offline, on your machineCompliance roadmap
These are commitments with dates, not aspirations. We are content to have them written into a contract.
Security controls built into the product
DoneCompleteRow-level security on every table, append-only hash-chained audit log, customer-held storage, per-recipient watermarking, organisational-account enforcement.
Verifiable in the running system. See the live checks above.
Data custody model documented and independently verifiable
DoneCompleteEvery column classified; four self-service verification queries published so each party can audit us without our help.
Data custody statement, available below.
Compliance platform and evidence collection live
In progressAugust 2026Continuous control monitoring, policy set adopted, personnel and vendor registers populated. Evidence collection cannot be applied retroactively, so this starts before anything else.
Independent penetration test
PlannedSeptember 2026Third-party application and infrastructure test, with the summary letter available to customers under NDA.
SOC 2 Type I report
PlannedOctober 2026An independent CPA firm attests that the controls are suitably designed as at a point in time. This is the first report we can actually hand over.
SOC 2 Type II observation window
PlannedOctober 2026 – January 2027A three-month period during which the auditor observes the controls operating. It cannot be shortened or backdated, which is why Type II is not available before then.
SOC 2 Type II report
PlannedFebruary 2027Attestation that the controls operated effectively throughout the window. Shared with customers under NDA, then annually.
ISO 27001 certification
PlannedUnder reviewAssessed after Type II, subject to demand. Roughly 80% of the controls overlap, so the incremental cost is modest.
Sub-processors
Your documents appear in exactly one row of this table: your own Microsoft tenant.
| Service | Role | Location | Attestation | Holds documents |
|---|---|---|---|---|
| Vercel | Application hosting and delivery | Configurable region | SOC 2 Type II | No |
| Supabase | Database, authentication, the negotiation record | Canada (ca-central-1) | SOC 2 Type II | No |
| Twilio | Phone verification at sign-in | United States | SOC 2 Type II, ISO 27001 | No |
| Microsoft | Your own tenant: Entra, Teams, SharePoint | Your tenant, your region | Your existing agreement with Microsoft | Yes, yours |
Three limitations we would rather you heard from us
- We see documents transiently. Comparing two versions needs the text in server memory. It is never written to disk or to the database, and the process holds no state, but “never stored” is not the same as “never seen”. A customer-side agent that computes the comparison inside your own tenant is on the roadmap.
- Watermarking is a deterrent, not a control. It defeats the careless forward and the photographed screen. It does not stop somebody retyping a clause.
- Metadata is not nothing. Clause counts, the timing of changes and who read what are genuinely informative. We hold them because the product cannot work otherwise, and we log every access to them.