Security

Where your data lives

Your data stays inside the EU.

Convorge runs on servers in the European Union. Our email is sent from the European Union as well. Ask us for the details of our hosting.

Encryption

Data is locked in transit. Keys and tokens are locked at rest.

Every connection to Convorge uses TLS. Passwords are stored as hashes, never as plain text.

Your e-sign keys and drive tokens are encrypted with a key that is kept outside the database.

Keeping customers apart

Each customer's data is kept apart from the rest.

Every customer table in our database uses row-level security. That means the database itself refuses to show one customer's rows to another. Our own code cannot switch it off.

The counterparty portal uses a second database role. That role can see only what was shared, and it cannot reach your team's logins.

Who can see what

Roles decide what each person sees. Support access is logged.

Each person in your workspace has a role: owner, admin, editor or viewer. Each contract can be limited to certain people or teams.

When our staff opens your workspace to help you, the session is logged and marked, and your owner can see it.

Backups

We copy the database before each update. We keep the copies for 90 days.

We take a full copy of the database before every software update. We keep those copies for 90 days.

Ask us for our backup and recovery details.

The AI assistant

Your contracts go to the AI to be read, never to be learned from.

To read a contract, we send its text to our AI provider in the United States. The provider does not train its models on that data. A person confirms what the assistant found before it counts.

Electronic signature

Signing runs through SignForge. The signed copy comes back to the contract.

Convorge sends documents for signature through SignForge. The signed copy and its proof are stored with the contract in Convorge.

Companies that help us

A few companies help us run Convorge. Ask us for the list.

A few companies process data for us: hosting in the European Union, email delivery, our AI provider, our electronic signature partner, and Microsoft or Google only when you connect a drive. We share the full list with customers on request.

If something goes wrong

If there is a breach, we tell you within 72 hours.

If we confirm a breach that affects your data, we will tell you within 72 hours. We will say what happened, what data was involved, and what we are doing about it.

Report a problem

Write to hello@ctrl18.com. We reply to each report.

If you find a security problem, write to hello@ctrl18.com. Tell us what you found and how to see it. We answer every report and we will not take action against you for reporting in good faith.

Security questions

Ask us your security questions. We will answer them.

Ask us at hello@ctrl18.com for our security documentation. We will answer your questionnaire.