Data & Privacy
Where is my data stored?
Your data is stored in secure, SOC 2 certified data centers in the United States by default. All data is encrypted at rest using AES-256 encryption and in transit using TLS 1.3.
Do you train AI on our data?
No. We never use your data to train AI or machine learning models. Your documents are processed only to provide services to you and are never shared with third parties for training purposes.
Who can access my documents?
Only users you authorize can access your documents. We use role-based access control (RBAC) allowing administrators to define granular permissions for who can view, edit, or delete contracts.
What is your data retention policy?
Active account data is retained for the duration of your subscription plus 30 days. Deleted documents are purged within 30 days, and backups are retained for a maximum of 90 days.
What happens to my data after contract termination?
Upon account cancellation, your data is retained for 30 days in case you change your mind. After that, all data is permanently deleted from our systems, including from backups within 90 days.
Security
How is tenant isolation implemented?
Each customer's data is logically isolated at the database level. Access controls ensure that one customer's data is never accessible to another customer, even when using shared infrastructure.
What is your incident response process?
We have a documented incident response plan. In the event of a security incident affecting your data, we will notify you within 72 hours as required by GDPR and other regulations.
How do you handle vulnerability reports?
We welcome responsible disclosure of security vulnerabilities. Report issues to security@ultrassure.com. We commit to acknowledging reports within 48 hours and providing regular updates.
Authentication & Access
Do you support SSO/SAML?
Yes, we support SSO integration with major identity providers including Okta, Azure AD, and Google Workspace. SSO is available on our Enterprise plan.
Do you support SCIM provisioning?
SCIM automated user provisioning is available for Enterprise customers upon request. This allows you to sync users and groups from your identity provider.
What events are captured in audit logs?
We maintain comprehensive audit logs of all significant user and system actions. Logs are retained for 1 year by default, with extended retention available for enterprise customers.
Compliance & Legal
Who are your subprocessors?
We use trusted third-party service providers including AWS, Supabase, Cloudflare, Stripe, and AI providers like OpenAI and Anthropic. All are bound by data protection agreements.
Is a DPA available?
Yes, we offer Data Processing Agreements (DPA) including Standard Contractual Clauses for GDPR compliance and international data transfers. Request via support@ultrassure.com.
Do you offer dedicated environments?
Yes, dedicated environments with isolated infrastructure are available for Enterprise customers with specific compliance or security requirements.
Can we restrict AI model providers or regions?
Enterprise customers can specify preferred AI model providers and restrict processing to specific geographic regions based on compliance requirements.
Still have questions?
Our security team is happy to answer additional questions. Reach out at security@ultrassure.com and we'll respond within 24 business hours.