Security & Trust

1. Overview

We use a combination of application controls, infrastructure protections, third-party providers, and operational safeguards designed to protect customer data and keep the platform reliable. No system is perfectly secure, but we aim to reduce risk through sensible architecture, restricted access, and ongoing product hardening.

2. Access Controls

• Users authenticate through managed identity infrastructure.
• Organization data access is scoped server-side based on the authenticated user record.
• Admin-only organization and team-management actions are role-gated.
• Ownership, billing transfer, and member-management flows include server-side guardrails.

3. Data Hosting and Storage

SLAVault uses managed cloud infrastructure for core application services, including authentication, application data storage, and file storage. Access to customer data is intended to be limited to authorized application paths and approved service providers that help us operate the platform.

Uploaded files and contract-related metadata are handled through the application's storage and processing pipeline. Document upload types and sizes are restricted to reduce abuse and operational risk.

4. Billing and Payments

Payment processing and subscription billing are handled through Stripe. SLAVault does not store full card numbers in application-managed records. Subscription and billing state are synchronized through controlled billing flows and webhook processing.

5. AI Processing

When you use AI-powered features, contract text, excerpts, metadata, or prompts may be sent to configured AI providers only as needed to power extraction, summarization, or contract-chat functionality.

AI requests are subject to application-level limits and plan-based usage controls. AI-generated outputs should be reviewed by a human and should not be treated as legal advice.

For more on vendors used to operate the platform, see our Subprocessors page.

6. Monitoring and Reliability

• Critical application flows include server-side monitoring and failure visibility measures.
• Billing webhook processing includes persistence and idempotency protections.
• Reminder scheduling and alert delivery are designed to run through controlled background execution paths.
• High-cost or abuse-prone endpoints use validation, limits, and throttling controls.

7. Incident Response

We investigate suspected security issues, service failures, and reports of abuse as they are identified. When needed, we may take steps such as restricting access, invalidating problematic workflows, patching affected code paths, or coordinating with relevant service providers.

8. Security Contact

If you have a security question, vendor review request, or want to report a potential issue, contact us at:

SLAVault
Email: support@slavault.com