Security | NDA.company

NDA.company is built to handle sensitive business documents. Security isn't a feature we added — it's how the product was designed from day one. Here's how we protect your data.

Infrastructure & Hosting

NDA.company runs on Supabase and Vercel, both of which provide enterprise-grade infrastructure. All data is hosted in SOC 2-compliant data centers within the United States. Our database is managed by Supabase with automatic backups, point-in-time recovery, and network isolation.

Encryption

All data is encrypted in transit using TLS 1.2 or higher. Data at rest is encrypted using AES-256 encryption. This applies to all NDA documents, user information, and signing records stored in our systems.

Authentication & Access

User authentication is handled through Supabase Auth with support for email/password and social login providers. All sessions use secure, HTTP-only cookies. Row-level security policies ensure that users can only access their own NDAs and data — no user can view, modify, or delete another user's documents.

Signing Security

When a recipient receives a signing link, the link is unique, time-limited, and tied to a specific NDA. Signing events are logged with timestamps and IP addresses to create an audit trail. Signed documents cannot be modified after execution.

Payment Security

All payment processing is handled by Stripe. NDA.company never stores credit card numbers, CVVs, or other sensitive payment data on our servers. Stripe is PCI DSS Level 1 certified — the highest level of payment security certification.

Data Retention & Deletion

You own your data. Active subscribers can export their NDAs as PDFs at any time. If you cancel your account, you can request full deletion of your data by contacting support. We do not sell, share, or monetize user data under any circumstances.

Responsible Disclosure

If you discover a security vulnerability, please contact us at security@nda.company. We take all reports seriously and will respond promptly.

Questions about our security practices? Reach out to security@nda.company.