Security measures across the TODO.LAW stack
What applies to every product we host: DPO Central, AI Sentinel, Dealroom and VendorWatch. Each product's own security page adds what applies to it alone.
Common measures
Hosting
The TODO.LAW suite runs on Vercel, with PostgreSQL databases managed by Neon.
Encryption
Every connection to the products uses HTTPS (TLS). Our hosting provider encrypts stored data with AES-256. Our database provider requires TLS on every database connection and encrypts stored data with AES-256.
Sign-in
No product uses or stores passwords. On our cloud you sign in with a Google account or with a single-use link sent by email, and one sign-in works across the TODO.LAW apps. The session is kept in a secure, HTTP-only cookie (SameSite=Lax), and sign-in requests are rate-limited. The passwordless sign-in that the self-host kits offer for a private network is refused on our cloud.
Access checks
Each product checks on the server, in its own code, that you may see or change a record before it does so: by organization and role in DPO Central and AI Sentinel, by your part in each deal in Dealroom, and by your account in VendorWatch.
AI
AI features are switched off by default; while they are off, no product sends anything to an AI provider. When an administrator switches them on, the text of the record being drafted goes to the AI provider set up on the service. VendorWatch sends none of your data to an AI provider.
Payments
Payments go through Stripe, so card details never reach our servers. We check the signature of every payment event Stripe sends us and reject any event that fails the check.
Sign-in links and notices are sent through Resend.
Backups
Data on our cloud is covered by our database provider's point-in-time restore. On your own hardware, DPO Central, AI Sentinel and Dealroom include a script that makes encrypted database backups; you set the schedule and keep the copies.
Your own hardware
DPO Central, AI Sentinel and Dealroom run the same code on our cloud and on your own hardware; the differences are settings, not separate versions. On your own hardware your data stays there unless you connect an outside service, such as an AI provider. VendorWatch is offered on our cloud only.
Certifications
We do not hold a security certification of our own, such as SOC 2 or ISO 27001. Our providers publish their own: Vercel (SOC 2 Type II, ISO 27001), Neon (SOC 2 Type II, ISO 27001, ISO 27701), Resend (SOC 2 Type II) and Stripe (PCI DSS Level 1, SOC 2 Type II). The sub-processor list gives each provider's role and where the data is kept. Sub-processor list.
Reporting a vulnerability
Write to security@todo.law. Please do not open a public issue. We acknowledge every report and keep you informed until it is fixed.
What each product adds
DPO Central
Five roles (Owner, Admin, Privacy Officer, Member, Viewer), checked on every change to organization records. An organization audit trail with CSV export. A Content Security Policy and two-year HSTS. Google sign-in tokens are removed before the account link is stored. On our cloud, personal data in a rights request is removed 30 days after the request is closed.
Security pageAI Sentinel
Five roles (Owner, Admin, AI Officer, Member, Viewer); Viewers have read-only access to governance records, enforced on the server. An audit trail of changes to governance records and key decisions. HSTS, and headers that block framing, content-type sniffing and access to the camera, microphone and location.
Security pageDealroom
Apart from the service's administrators, only a deal's parties can see it. A counterparty joins through an emailed invitation that can be used once and expires after 14 days. Deal, negotiation and signing actions are written to an audit log. The administration portals require a second factor (an authenticator app). Contract documents are generated on request and are not stored as files. AI is switched on or off for the whole service by its operator. The pages use an analytics service that sets no cookies to count visits.
VendorWatch
On our cloud only. API keys are stored only as a hash and shown once. Deleting an account removes its personal records and anonymizes shared ones. Headers that block framing, content-type sniffing and access to the camera, microphone and location. The pages use an analytics service that sets no cookies to count visits.