Security
How we protect your contracts
Contracts hold your most sensitive terms. Here is exactly how we handle them, in plain language.
Your data
Encrypted at rest
Uploaded files, extracted contract text, findings, summaries and key terms are encrypted with AES-256-GCM before they are stored.
Encrypted in transit
All traffic to Baxendale uses HTTPS, and connections to our database require TLS.
Private to your organization
Every request is scoped to your organization’s workspace. People outside it can’t see your contracts.
Never used to train AI models
Your contracts are used to produce your review and nothing else.
Access
No passwords to steal
You sign in with a one-time code sent to your email. Codes expire after five minutes, and repeated attempts are rate-limited.
Short sessions
Sessions end after six hours, and signing out ends them immediately. The session cookie can’t be read by scripts on the page.
Roles
Owners, admins and members have different permissions, and only owners and admins can invite people.
Activity log
An append-only record of who did what in your workspace, which you can export to CSV.
How we build
- Our application logs never contain contract text, sign-in codes or session tokens.
- A finding is shown only if its quote is found word for word in your document, so the analysis can’t invent clauses.
- This website sets no cookies and runs no analytics or tracking scripts.
Questions from your security team?
We’re happy to walk through how Baxendale handles your data, and to help with your security review. If you think you’ve found a vulnerability, please tell us privately.
Every contract deserves a careful first read.
We’re onboarding teams one at a time. Tell us about the contracts you review and we’ll set up your workspace.