Security at Kordvik

Kordvik holds your contracts — some of the most commercially sensitive documents your business has. This page describes, plainly, how we protect them. It is maintained alongside our internal threat-model review and updated as the platform evolves.

Your documents never leave for third-party AI

Kordvik's AI features — PDF extraction, clause-level risk review, vendor benchmarking, negotiation drafting — run on a language model hosted on Kordvik's own infrastructure. Contract text and document images are not sent to OpenAI, Anthropic, Google, or any other external AI provider, are never used to train models, and do not persist in the model server beyond the request. If we ever offer a vendor-managed AI option, it will be opt-in and reflected in the subprocessor list first.

Tenant isolation

• Every record is partitioned by workspace. Access requires an accepted membership in that workspace; cross-tenant lookups return "not found".
• Role-based access control (Admin / Editor / Viewer) is enforced server-side on every mutating action — a disabled button is never the only barrier.
• Bulk export of the contract book is restricted to Editor+ roles.

Account security

• Two-factor authentication (TOTP) and passkeys/WebAuthn supported on all accounts.
• Email confirmation required at signup; account lockout after repeated failed logins; per-IP rate limiting on all authentication endpoints.
• Sessions are invalidated promptly when an account is deactivated.

Encryption

• All traffic is encrypted in transit with TLS; HSTS is enforced.
• Integration credentials (Slack, Google, Microsoft OAuth tokens) are encrypted at rest with dedicated key material.
• Card details never touch our servers — payment is handled by Stripe, a PCI-DSS Level 1 provider.

Application hardening

• Content-Security-Policy and modern security headers on every response; anti-forgery protection on all forms.
• All database access is parameterised through an ORM — no raw SQL.
• Inbound webhooks are authenticated (signature-verified for Stripe and email ingestion) and rate-limited; ingestion fails closed when no shared secret is configured.
• Upload size limits and content validation on document ingestion paths.

Auditability

Data-changing actions are written to a per-workspace activity log visible to your team, and platform-level administrative actions are separately audited.

Your data, your rights

• Self-serve export: CSV export of contracts and vendors, plus a personal-data download.
• Self-serve deletion: workspace deletion (typed-name confirmation) and full account deletion are built into the product.
• GDPR processor terms and the subprocessor list are public in the DPA.

Operations

• Databases are backed up nightly, and the restore procedure is documented.
• Application logs are retained for 14 days and errors are reported to an error-monitoring service; logs never contain secrets or tokens.

Compliance roadmap

Kordvik is built and operated in the EU under the GDPR. SOC 2 certification is on our roadmap as the platform grows; we are happy to complete security questionnaires for prospective customers — just ask.

Responsible disclosure

Found a vulnerability? Please email support@kordvik.com with the details. We commit to acknowledging reports within 3 business days, we will not pursue good-faith research conducted without harming customer data or service availability, and we will credit reporters who want it once a fix ships.