Tenant isolation
Every stateful query carries an organization boundary. Server-side authorization protects reads, writes, exports, integration callbacks, and administration.
Contract management software security a buyer can inspect.
Review how Reloren isolates organizations, encrypts contract sources, preserves immutable execution history, controls identity, exports audit evidence, and restores state before client agreements move into the system.
Encrypted originals
Retained source bytes use AES-256-GCM with organization-bound authenticated context. Documents are stored behind opaque object paths.
Immutable records
Source document versions, obligation events, and client decision history cannot be updated in place at the database layer. Corrections create new records.
Authentication
Random sessions are hashed at rest, HTTP-only, SameSite, expiring, and revocable. Supabase Google tokens are verified against issuer signing keys.
Enterprise identity
OIDC supports Authorization Code with PKCE, signed identity-token validation, domain restriction, and encrypted client secrets. SCIM supports user provisioning.
Billing and integrations
Stripe webhooks are signature-verified and replay-protected. Composio holds provider authorization; the app stores workspace-scoped connection identifiers.
Recovery
SQLite runs in WAL mode with integrity checks. Backups support independent encryption, off-box storage, and restore verification.
Runtime hardening
The VPS container runs non-root behind TLS with a read-only filesystem, dropped capabilities, security headers, health checks, and resource limits.
Evaluate contract data security across the full lifecycle.
Contract repository and contract management software buyers consistently evaluate storage, permissions, version history, identity, auditability, backup, and portability. Reloren documents the implemented controls and the current assurance boundary without substituting a certification badge for technical review.
Protect the source document and its operating context.
Uploaded contract files are retained behind opaque object paths and encrypted with AES-256-GCM. Organization-bound authenticated context helps prevent encrypted data from being moved across tenant boundaries without detection. Document metadata, obligations, evidence, decisions, and value events remain scoped to the organization.
Supported sources include PDF, DOCX, TXT, Markdown, and EML files up to 25 MB. The system stores extraction status and warnings so a missing or unreadable text layer is visible rather than silently treated as a successful review.
Preserve version and event history.
Contract documents are immutable at the database layer. Amendments and replacements create new versions with an amends, supersedes, or incorporates relationship. Obligation events and client decision history are also append-only, preventing ordinary application updates from rewriting the sequence a reviewer saw.
Organization audit events record actor, action, target, timestamp, and supporting metadata. Authorized users can export audit history for review. These controls support evidence gathering; they do not independently establish legal or regulatory compliance.
Control user, API, and integration access.
Workspaces support roles, invitations, session expiry, revocation, Google authentication, OIDC, and SCIM. API keys and SCIM tokens are one-way hashed, while client secrets use encryption. Scoped API keys can limit integration behavior such as evidence writes or portfolio reads.
Optional Composio connections broker provider authorization so the application stores workspace-scoped connection identifiers rather than requiring users to paste third-party credentials into contract records. The direct Reloren workflow remains usable without an integration.
Verify backup, restore, and deployment controls.
The stateful application uses SQLite in WAL mode with integrity checks. Backup creation supports separate encryption and signed S3-compatible off-box transfer. Restore verification checks the encrypted database instead of assuming a copied file is recoverable.
The VPS deployment runs a non-root container behind TLS with a read-only filesystem, dropped Linux capabilities, health checks, resource limits, and security headers. The public marketing build is separate and does not retain contract evidence.
Understand the current assurance boundary.
Reloren does not claim SOC 2, ISO 27001, HIPAA, PCI, GDPR certification, or another independent assurance status without current evidence. Buyers should evaluate implemented controls, deployment scope, data-processing terms, incident expectations, retention, subprocessors, and their own regulatory obligations.
Review the trust center, data processing addendum, privacy notice, and service terms before sending customer contract data.
Contract software security questions.
Are contract files encrypted?
Yes. Retained source bytes use AES-256-GCM with organization-bound authenticated context, and durable backups can use independent encryption.
Can one organization access another organization’s contracts?
Stateful queries and authorization checks carry an organization boundary. The application tests tenant-scoped persistence and operations as part of its unit suite.
Does Reloren support SSO and provisioning?
Yes. The enterprise control plane supports OIDC configuration and SCIM user provisioning, in addition to direct sessions and Google authentication.
Are contract versions editable?
No. Retained document versions are immutable. A correction or amendment creates a new version and can record its relationship to earlier sources.
Is Reloren SOC 2 certified?
No current SOC 2 certification is claimed. The site lists implemented controls so buyers can evaluate the present product honestly.
Verify before data moves.
Vulnerability reports can be sent to the support address on the invoice. Procurement reviewers can use the linked legal and technical documents above.