Security, by design.
Every closing runs on documents that must be protected — contracts, financials, identity, and money. Here is how we safeguard yours.
How we protect your deal
Encryption everywhere
TLS 1.3 in transit and AES-256 at rest. Document uploads are encrypted end-to-end between your browser and our storage.
Least-privilege access
Only members of your deal room can read its files. Internal access requires SSO, MFA, and is logged and time-bounded.
Continuous monitoring
Runtime detection, dependency scanning, and 24/7 alerting on our production environment, with paged on-call response.
U.S. data residency
Customer data is hosted in isolated, SOC 2-audited AWS regions in the United States, with redundancy across availability zones.
Backups & recovery
Encrypted, versioned backups with defined RPO/RTO. Restores are tested quarterly.
Responsible AI
CREdili Counsel AI runs on isolated tenancy and does not use your deal content to train foundation models for other customers.
Our practices
- Secure SDLC — mandatory peer review, automated testing, and SAST/DAST on every change.
- Vendor review — subprocessors are assessed for security and privacy before use.
- Incident response — documented playbooks, customer notification within 72 hours of a confirmed material incident.
- Employee security — background checks, mandatory training, hardware-backed MFA, and enforced device management.
- Retention & deletion — data is retained for the life of your deal and legal obligations, then securely deleted.
Reporting a vulnerability
We welcome coordinated disclosure. If you believe you’ve found a security issue, please email contact@credili.ai with a description, reproduction steps, and any relevant proof. Please do not test against production data or other customers. We will acknowledge receipt within two business days.
Need our security package?
We share our SOC 2 report, penetration test summary, and DPA under NDA.