Security & privacy
Your contract is kept, private, and clickable
An executed real estate contract is sensitive. Here is exactly what happens to a file you upload, what we keep, and what we don't yet offer.
Principles
How Contract10 treats your data
Your contract lives in a private, per-owner bucket
Uploaded contract PDFs are stored at contracts/<your account id>/<transaction id>/<file>.pdf in a private storage bucket. Postgres Row Level Security scopes every row and every file to the account that owns it, so another account's data isn't reachable through the API, the app, or a shared key.
That's what makes a deadline clickable
Because the source PDF is kept, every deadline is labelled with the page it was read from and opens that page of your contract, so you can check the clause yourself instead of trusting a summary.
Deadlines are computed, never hand-edited
The deadlines table holds only what the engine computed from your contract's fields. Correct a field (say, a misread inspection period) and the engine recomputes every downstream deadline that depends on it, so a deadline can't silently drift out of sync with the contract.
Encrypted in transit
Every upload and every API call runs over HTTPS/TLS. Your account, transaction and API usage data live in Postgres (Supabase), with access restricted to what's needed to operate the Service.
Single-key API auth, revocable any time
The API and MCP server use one bearer key per environment (c10_live_... / c10_test_...). Rotate or revoke a key instantly from your account if it's ever exposed; the key value itself is shown only once, at creation.
Not legal advice
Contract10 computes deadlines from the contract you upload. It is not legal advice and it does not replace your broker's review. Automated extraction can misread a poor scan, so every extracted field cites the page it came from and every deadline shows the arithmetic behind it. Confirm against the executed contract before you rely on a date.
What we don't yet offer
- SOC 2 or similar third-party security certification.
We'd rather say this plainly than let silence imply a compliance status we haven't earned.
FAQ
Security questions
Do you keep a copy of the contract I upload?
Yes. It's stored in your own private storage bucket, scoped to your account by Row Level Security, so a deadline can link back to the exact page it came from. See the principles above for the storage path.
What data do you keep?
The contract PDF, the fields the engine read off it (page-cited, user-editable), the deadlines it computed from those fields (never hand-edited directly, recomputed when you fix a field), and your account, billing and API usage data.
Is my data encrypted?
All traffic to and from Contract10 runs over HTTPS/TLS. Stored data lives in Postgres and private storage with access restricted by Row Level Security.
Can other accounts see my transactions or my contract?
No. Row Level Security scopes every transaction, contract field, deadline and file to the account that owns it.
Do you offer a SOC 2 report?
Not yet, we say so plainly rather than implying a compliance status we haven't earned. If that's a hard requirement for you, contact us before uploading a contract that would require one.
Read the full privacy policy
Details on what we collect, why, and how to delete it.