Security
Agreements and contracts are commercially sensitive. Here's how Licens stores and protects your data.
Draft – must be reviewed by a lawyer before launch.
How we protect your data
Stored in the EU/EEA
Database, authentication and file storage are run by Supabase in an EU region. The application is hosted by our hosting provider. See the list of sub-processors.
Encryption
All traffic between your browser and Licens is encrypted with TLS. Data and files are encrypted at rest in line with the sub-processor's standard.
Isolation between organisations
Row-level security in the database ensures users can only access data in organisations they belong to. One organisation can never see another's data.
Two-factor authentication
Users can enable two-factor authentication with an authenticator app (TOTP).
Private documents
Documents are kept in private storage and opened only through short-lived signed links.
Role-based access and logging
Roles control what each user can see and change. Every change to an agreement is logged with who, what and when.
Operations and backups
Licens is operated by Itema AS. The database is backed up automatically by our database provider. We use rate limiting to protect against abuse, and we don't write personal data to application logs. Error logging is handled by a sub-processor in the EU.
Access to the production environment is limited to the Itema AS employees who need it to run the service. We don't access customer data unless it's necessary to provide support the customer has asked for, or to comply with legal requirements.
Responsible disclosure
If you think you've found a security weakness, we want to hear about it. Send us an e-mail describing what you found and how to reproduce it. Please don't access, modify or delete other people's data, and give us reasonable time to fix the issue before making it public. We'll acknowledge your report and keep you updated.