Trust and security
The controls your auditors will ask about.
Your deal data is held to the discipline a lending institution applies to its own records. Figures are computed in code from your deal terms and clauses are reproduced verbatim from the US authority they cite — no language model reads your data or drafts your documents, and nothing is ever used to train or improve any model. This page sets out, in full, the security controls, compliance frameworks, and data practices behind the platform, so your security team and counsel can diligence them directly.
Last updated: July 20, 2026
Data Encryption
Encryption at Rest
In placeStored documents and data are sealed with AES-256 server-side encryption on AWS S3.
Encryption in Transit
In placeTLS 1.2+ is enforced on every connection, with HSTS set to a two-year max-age.
Database Encryption
In placePostgreSQL data is encrypted at rest on Supabase managed infrastructure.
Password Hashing
In placeShare-link passwords are hashed with bcrypt at a cost factor of 12 and never stored in the clear.
Access Control
Role-Based Access Control
In placeFour roles govern reach: Owner, Admin, Member, and Viewer. Permission is checked at every API endpoint.
Authentication
In placeSingle sign-on runs through Clerk, with multi-factor authentication supported for your team.
API Key Management
In placeAPI keys are stored as SHA-256 hashes, scoped per key, and rate-limited per key.
Session Management
In placeSessions use secure tokens that expire automatically, managed through Clerk.
Data Protection
Document Integrity
In placeA SHA-256 checksum is computed at generation and retained for every document, so any later alteration is detected on verification.
Audit Trail
In placeAn append-only log records actions on your deals and documents, including API calls that change data, with the originating IP. Read-only requests are not logged.
Data Retention
In placeRetention is enforced on a schedule: audit logs for two years, share links for thirty days past expiry, webhook logs for ninety days.
Secure Document Sharing
In placeShare links are time-limited, with optional password protection, view caps, and revocation under your control.
Infrastructure Security
HTTP Security Headers
In placeContent-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy are set on responses.
Rate Limiting
In placeFour tiers of rate limiting protect the endpoints: dashboard 60/min, write 20/min, public 30/min, and export 5/min.
Webhook Security
In placeWebhook payloads are signed with HMAC-SHA256 and auto-disabled after ten consecutive failures.
Input Validation
In placeEvery API input is validated server-side, and all database queries are parameterized through the Prisma ORM.
Privacy and Data Rights
Data Export
In placeYour organization can export all of its data as JSON, on demand, for portability and your own records.
Right to Erasure
In placeA deletion request removes the organization's database records and stored objects in full.
Data Minimization
In placeWe collect only what a document requires. There are no tracking pixels and no third-party analytics.
Sub-processor Transparency
In placeThe sub-processor list below names every third party that touches your data, with its purpose and location.
Compliance Frameworks
SOC 2 Type II
ScheduledPreparing for SOC 2; our controls are built to that standard. No report has been issued yet.
CSA STAR Level 1
UnderwayThe self-assessment questionnaire is in progress.
EU/UK data subject requests
In placeData export, deletion, and consent handling are supported; a Data Processing Agreement is available on request.
CCPA
In placeCalifornia Consumer Privacy Act obligations are met through the same data-rights controls.
Sub-processors
The third-party services below process data on behalf of OpenShut. Each processes data under its standard data protection terms; copies are available on request. Each is named here with its purpose and where it sits.
| Service | Purpose | Location |
|---|---|---|
| Vercel | Application hosting and edge delivery | United States |
| Supabase | Managed PostgreSQL database | United States (AWS us-east-1) |
| AWS S3 | Encrypted document storage at rest | United States (us-east-1) |
| Clerk | Authentication, single sign-on, and identity | United States |
| Inngest | Background job orchestration | United States |
| Stripe | Per-deal payment processing | United States |
Data Processing Agreement
A Data Processing Agreement is available to any client whose compliance posture calls for one. Your counsel can request the current copy from lav@openshut.me.
Security Contact
To report a vulnerability or request our security documentation for your diligence file, write to lav@openshut.me.
Put it in front of your security team.
Request the data-handling summary and DPA, or generate one document at no cost and read the audit trail behind it for yourself.