Security and data handling
Legal teams need clear data handling before sending contract text into any AI workflow. This page documents the baseline controls included in this deployment package.
TLS by default
Deploy behind HTTPS and require encrypted transport for all API requests.
CORS allowlist
The backend now defaults to Attyflow domains and localhost for development instead of allowing every origin.
Input validation
Audit requests include length limits to reduce misuse and accidental oversharing.
No low-risk fallback
If the AI provider fails, the API returns an error instead of mislabeling a clause as low risk.
Recommended production hardening
Before public launch, add account authentication, organization-level audit retention controls, vendor DPA review, and security monitoring.