Security & Trust Center

• Customer content — projects, clause assessments, Company Positions and uploaded documents — belongs to the customer and is processed only to deliver the Service.
• All application traffic is served over encrypted HTTPS/TLS connections.
• ClauseBridge runs on managed cloud platforms for hosting, database, authentication and file storage. ClauseBridge does not operate its own servers or data-centre hardware.
• Each organisation's data is separated logically and checked on every database request, so one customer cannot reach another customer's information.
• Access by ClauseBridge personnel is limited to what is necessary to support, secure and operate the Service.
• ClauseBridge does not sell customer content and does not use customer content to build public editorial material.

• Everything beyond the public website requires an authenticated user account.
• New accounts must confirm their email address before the account can be used.
• Passwords and sessions are handled by a managed authentication platform; password reset is available from the sign-in page.
• Access is organisation-based: users see the projects, documents and positions belonging to their own organisation.
• Roles (user, reviewer, editor, administrator) are stored and enforced on the server, not in the browser. A browser cannot grant itself elevated access.
• Colleagues gain access only when an authorised user of the organisation invites them.
• Multi-factor authentication and enterprise single sign-on (Microsoft Entra ID, SAML) are planned and not available today.

• Organisations are logically separated. Projects, documents, assessments and Company Positions are scoped to the owning organisation.
• Information is visible only to authorised users of your organisation, and to ClauseBridge personnel where necessary for support, security and operation.
• Cross-organisation visibility only happens deliberately: a user invited into your organisation, or a share link created by one of your authorised users.
• AI analysis runs only when a user explicitly starts it, and only the text needed for that analysis is sent to the AI provider. AI output is decision support and is reviewed by a person.
• Uploaded documents are restricted by file type and size, and are deleted together with the project or document they belong to.

Suitable for ClauseBridge: public FAR/DFARS and solicitation material, and ordinary business-confidential contract information such as internal clause positions, commercial assessments and project notes.

ClauseBridge processes personal data as a processor for customer workspaces, and as a controller for its own account, billing and marketing data. Legal bases, categories of data and data subject rights are described in the Privacy Policy.

ClauseBridge does not state that all processing takes place in Norway, the EEA or the EU. Customer information — in particular text submitted for AI analysis — may be processed outside Norway and the EEA, including in the United States. Where a specific data-residency arrangement is required, contact the security team before processing regulated information.

A standard data processing agreement and the current subprocessor list are available on request.

ClauseBridge separates technical security controls from formal regulatory compliance. The table below states our position framework by framework. No entry is shown as certified, compliant or authorised without verified evidence supporting that exact statement.

Documentation available during supplier review

• Security Overview (PDF)Planned
• Data Processing AgreementPlanned
• Subprocessor listActive
• Technical and organisational security measuresPlanned
• Security questionnaire responsesPlanned
• Data flow overviewPlanned
• AI processing overviewActive

ClauseBridge does not issue certifications or third-party assurance reports it does not hold.

Need more detailed security information?

Security, IT and privacy teams may request additional information for supplier assessment and due diligence. We provide detailed material directly rather than publishing it here.