SECURITY & TRUST
What we do, and what we won't claim.
You're being asked to trust a platform with your contracts, your costs and your commercial terms. That deserves specifics, not badges.
Data in the EU (London)
platform data, including uploaded documents, is hosted with Supabase in the London region. Providers and locations are on the subprocessors page.
Workspace isolation, enforced in the database
row-level security on every table means each workspace's records are isolated at the database layer, not just in application code.
Sign-in without passwords
magic-link email sign-in or Microsoft Entra ID. With Entra, your own conditional access and MFA policies apply to Renewals360 automatically.
Private document storage
contracts, quotes, POs and invoices live in private storage; access is via short-lived signed URLs issued only to authorized users in your workspace.
Soft delete only
deletions are recoverable, nothing is silently destroyed, and your data lifecycle stays on your terms with retention and deletion controls.
Append-only audit log
every action attributed and timestamped in a log that can be added to but never edited.
Role-based access
people see what's relevant to their role; leadership keeps the full picture. Viewer access is free, so oversight never costs a seat.
Hardened edges
encryption in transit and at rest, strict security headers on both properties, and rate limiting on the public endpoints.
Exportable records
your data is yours; take a complete export, including documents, at any time.
Responsible disclosure
found a vulnerability? Tell us at hello@renewals360.com and give us a reasonable chance to fix it. We are grateful to researchers who report responsibly.
Privacy-first by design
Processing limited to what the service requires, retention and deletion controls in the product, and a plain-language privacy policy.
We run our own medicine
our own backups and failover tests are tracked as recurring obligations in Renewals360.
Live status, in public
Uptime and incident history are published on our status page, the same one we watch.
We don't hold ISO 27001 today, and you won't find a badge on this page pretending otherwise.
Our rule is simple: we only claim what we've built. What you've just read is exactly what's in place, and when a certification is in progress, this page will say "in progress", not "certified". A certification roadmap is available on request, and if your procurement process needs more detail, ask: we'll walk you through it, honestly.