Where your contract goes, and who can see it.

What happens to a contract

1. Upload. A signed-in member of your organization uploads the contract as PDF files. They are stored in your organization's own area of our file storage, and only members allowed to make changes can upload.
2. Reading and analysis. Our servers on Google Cloud send the contract's content to Anthropic's Claude model, which reads it and drafts findings.
3. Checks in code. Our code, not the AI model, scores each finding's severity against the review playbook. It checks that the quoted language appears on the cited page, corrects the page number when it doesn't, and drops findings that have no source.
4. Results. The report is saved in your organization's workspace, where other customers can't reach it.
5. A person decides. Your reviewers mark each finding Accept, Negotiate or Review. The Word redline includes only the items a person has marked Ready.

Free reviews follow the same rules. If you attach your contract on the free-review form, it goes to a private Cloudflare storage bucket, separate from the Console. Nothing on the website can read it back except our password-protected admin page, and only RivetData staff can open it. We use your contract only to prepare your review, a member of our team checks the report before we send it, the contract is never used to train a model, and we delete it when you ask.

Who can see it

• People in your workspace. Someone joins your workspace when they're added to it, or when they sign in with a verified email address at a company domain registered to your workspace. Every member can read the workspace's reviews. Read-only members can't run reviews or change them.
• Not other customers. Our database and file-storage rules tie access to workspace membership, and our server code checks membership again before it acts on a review.
• Anthropic, whose Claude model reads the contract to produce the review.
• RivetData staff, when needed to run the service, support you or fix a problem.

Keeping and deleting it

• We keep contracts and review results while your organization uses the service, unless they're deleted sooner. There is no automatic deletion schedule today.
• Workspace admins can delete a review in the Console. It disappears from view right away, and an admin can restore it.
• For permanent deletion, email [email protected]. We delete the review, the uploaded contract and the files generated from it.
• We keep backups so that we can recover from data loss. Deleting something doesn't immediately remove it from those backups.

Certifications

We don't have a SOC 2 report or an ISO 27001 certification today, and we don't claim to. If your team needs more detail, such as how data moves through the system, which providers process it, or answers to a security questionnaire, email [email protected] and we'll share our detailed security documentation.

Report a vulnerability

If you think you've found a security issue in rivet-data.com or the RivetData Console, email [email protected] with a description and the steps to reproduce it. We'll acknowledge your report and keep you updated while we fix it.

Please:

• give us reasonable time to fix the issue before you disclose it publicly;
• don't access, change or delete data that isn't yours, and stop as soon as you've confirmed the problem;
• don't degrade the service: no denial-of-service testing, spam, or social engineering of our staff or customers.

We won't take legal action against anyone who reports an issue in good faith and follows these guidelines.