Security & data handling
Built so that sharing is a small decision
Contracts and revenue data are among the most sensitive things a finance team holds. The scan is designed so you can get value from it without granting standing access to anything: no integrations, no credentials, no write access, and retention limits agreed in writing.
Read-only, by construction
The scan runs entirely from exports and documents you provide. We never receive credentials or API keys to your billing system, ERP, or CRM, and we hold no write access to anything. Nothing in your systems changes unless you change it.
You control the folder
Inputs go into a shared folder that you own and control — your Google Drive or equivalent. You can revoke our access at any time. There is no data pipeline running against your systems.
Scoped to the engagement
We ask only for what the agreed checks need: the contract package, an invoice or billing export, a revenue schedule, and — where relevant — usage exports and your rev-rec memo. The methodology page states exactly which input each check requires; we don't collect beyond that.
Redaction is fine
If your contracts contain terms you'd rather not share, redact them. Checks that depend on a redacted term simply report as not-run — the coverage statement in your report makes that explicit.
Used only for your scan, retention in writing
Your data is processed solely to produce your findings report. It is not used to train models. Working copies are deleted after the agreed engagement and retention period — and the engagement terms document where working files are held, which subprocessors (including AI model providers) process them and under what retention terms, when deletion happens, what remains afterward (your report and its findings), and who has access. You keep the report; your folder keeps the sources.
NDA before anything moves
We'll sign your NDA, or provide ours, before you share a single document.
Have a security questionnaire or specific handling requirements? Send them along with your scan request — we'd rather answer them before you share anything than after.
Questions first, documents later
Tell us about your stack and your constraints. Nothing gets shared until you're comfortable.
Request a scan