Security

Last updated: September 26, 2026

ContractBridge handles contract documents that are often confidential business information. Here's what we do to protect them.

Encryption

All traffic to ContractBridge is encrypted in transit over HTTPS/TLS. This applies to the website, the app, and the API.

Passwords and authentication

Passwords are hashed with bcrypt before storage. We never store or can see your actual password.
Password requirements enforce a minimum length and a mix of character types.
Sign-in uses a short-lived access token (30 minutes) backed by a rotating, server-side session token. Signing out immediately revokes the session — it doesn't just clear it from your browser.
Password reset links are single-use, expire after 1 hour, and resetting your password signs you out of all other active sessions.

API protection

Our API only accepts browser requests from our own official frontend domain (app.contractbridge.io) — other websites cannot call our API on your behalf from a browser.
Login and other sensitive endpoints are rate limited to prevent brute-force attempts and abuse.

Infrastructure

Database: your account and document data lives in a managed, encrypted database with automatic point-in-time recovery backups covering a rolling 7-day window.
Application hosting: ContractBridge runs on a managed cloud hosting platform with its own physical and network security controls.
Network: our domain is protected by a DNS and network-security provider that filters malicious traffic before it reaches our servers.

Monitoring

We use automated error monitoring to detect and alert us to application errors, so we can identify and fix problems quickly — often before a user needs to report them.

Data isolation

Your documents and account data are scoped to your account. Other ContractBridge users cannot access your contracts.

Reporting a security issue

If you believe you've found a security vulnerability in ContractBridge, please email support@contractbridge.io with details. We take reports seriously and will respond as quickly as we can.

Where we're headed

ContractBridge is an early-stage product, and our security program will grow with it. Areas on our roadmap include formal compliance certifications and more extensive audit logging as we take on more customers and more sensitive data.