Security

Security is foundational to Agreement. Legal documents and signatures are sensitive, and we take every measure to protect the confidentiality, integrity, and availability of your data. This page describes the technical and organizational controls we have in place.

Infrastructure Security

Data Isolation Architecture

Agreement uses a per-organization database model. Every workspace has its own isolated database with validated tenant identifiers checked on every request. There is no shared schema — an error in one tenant context cannot expose another tenant's data.

Encryption

All connections use TLS 1.2 or higher. HTTP Strict Transport Security (HSTS) is enforced, preventing downgrade attacks. Sensitive fields receive application-layer encryption before being written to the database. Backup snapshots are encrypted at rest.

Infrastructure Segmentation

Application servers and database servers operate on separate network segments. Database servers are not directly internet-accessible. The application process runs under a least-privilege account with no write access outside its designated directories.

Application Security

Authentication

• Passwords hashed with bcrypt (cost factor 12)
• Short-lived signed JWTs for session management, rotated on every request cycle
• TOTP two-factor authentication compatible with Google Authenticator, Authy, 1Password, and any TOTP-compliant app
• Rate limiting on login and registration endpoints to prevent brute-force attacks
• Account lockout after repeated failed authentication attempts

Role-Based Access Control

Agreement enforces role-based permissions at every API endpoint. Users can only access documents and actions permitted by their assigned role within their organization. Cross-organization access is architecturally prevented.

Input Validation and Injection Prevention

All database queries use parameterized statements — SQL injection is not possible. All HTML output is escaped to prevent XSS. File uploads are validated for type and scanned before storage. API inputs are validated against strict schemas with request body size limits.

Security Headers

Every HTTP response from Agreement includes:

• Content-Security-Policy — restricts script and resource origins
• X-Frame-Options: DENY — prevents clickjacking
• X-Content-Type-Options: nosniff — prevents MIME sniffing
• Strict-Transport-Security — enforces HTTPS for all connections
• Referrer-Policy: no-referrer — limits referrer leakage

E-Signature Integrity

Signed agreements are sealed with a tamper-evident audit trail. Each completion certificate includes the full chronological event log (views, signing actions, IP addresses, timestamps) and is cryptographically linked to the document content. Any post-signing modification to the document is detectable.

Agreement complies with the U.S. ESIGN Act and UETA, and produces basic electronic signatures under the EU eIDAS Regulation.

Audit Logging

We maintain comprehensive, append-only audit logs for all user actions, administrative changes, and authentication events. Logs include timestamps, actor identity, IP address, and affected resources. These logs are retained for a minimum of 12 months and are accessible to organization administrators within the platform.

Incident Response

In the event of a confirmed security breach affecting your data, we commit to:

• Notifying affected organizations within 72 hours of breach confirmation, consistent with GDPR Article 33 requirements
• Providing a clear description of the nature of the breach, data categories affected, and our response actions
• Cooperating with affected customers and relevant authorities throughout the investigation

Shared Responsibility

Security is a shared responsibility. We ask that you:

• Use a strong, unique password for your Agreement account
• Enable two-factor authentication, especially for administrator accounts
• Review and manage team member access regularly
• Log out of shared devices after use
• Report any suspicious activity to security@beezifi.com immediately

Vulnerability Disclosure

Contact Security Team