Security and data processing

Todai Contracts stores agreement documents that are legally binding, and personal data about the people who sign them. This page describes how we handle that. It's written so it can be used directly in a vendor assessment.

If you have questions that aren't answered here, write to us. We'll give you a concrete answer.

Hosting and data

Todai Contracts is hosted on Lovable Cloud in an EU region. Databases, file storage, authentication and server functions are all within the EU/EEA, and data is not moved between regions.

The underlying platform is built on Supabase, which runs on Amazon Web Services in the chosen EU region. The application layer is protected by a web application firewall, network isolation and rate limiting at IP, user and workspace level.

The data centers are SOC 2 and ISO 27001 certified with access control, monitoring and physical security around the clock.

On jurisdiction. We state this directly because it's relevant to your assessment: your data is stored in the EU, and AI processing takes place at approved sub-processors under an EU-approved transfer basis, but several of the suppliers in the chain are American companies. Lovable Labs Incorporated is registered in the US with a European entity in Stockholm, and Supabase Inc. is likewise American. So there is data residency in the EU, but not full European jurisdiction. The transfer basis is the European Commission's standard contractual clauses, supplemented by encryption in transit and at rest. If you assess that this isn't sufficient for your data, tell us — we'd rather have an honest conversation about it upfront.

Access control

Login. Access to Todai Contracts requires an individual user account. Shared accounts are not used. Login happens via Google SSO, so your own access management, including two-factor authentication and offboarding, applies here too: if an employee's Google account is closed, access to Todai Contracts is closed at the same time.

Roles. There are three roles: administrator, sender and reader. Only senders can create and send contracts. Readers can view, but not change or send. Administrators manage users, workspaces and settings.

Workspaces. Contracts can be kept separate in workspaces, each with its own members, templates and settings — for example customer agreements separate from employment contracts. Access is granted per workspace.

Enforcement in the database. Access control is enforced at the database level with row level security, not just in the user interface. This means a query bypassing the app returns the same as the app: only the data the user's role and affiliation give access to. This is the control that prevents one customer's data from being accessible from another customer's account.

API and AI access. API keys are created with specific permissions, have a name and creation date, show when they were last used, and can be revoked individually. Our MCP server, which lets you connect an AI client to your contracts, only grants read access and follows the individual user's permissions — an AI client cannot see more than the user themselves can.

Signers. The people you send contracts to don't have an account and don't get access to the system. They receive a unique, time-limited link to the specific document they need to sign.

Audit trail

Every contract has an audit trail that records events with a timestamp, user and IP address: creation, changes, sending, when the document was opened and by whom, and the signature itself.

The trail cannot be changed or deleted — not even by an administrator at your company, and not by us either. This is enforced in the database, not just in the user interface. An audit trail that can be edited has no evidentiary value, which is why it's built this way.

The audit trail travels with the signed PDF, so the documentation lives in the document itself and not only in the system. This means the evidence still exists if you ever leave Todai Contracts.

Internal comments on a draft are not part of the audit trail and are permanently deleted once the contract is sent.

Quality of signature as evidence

How it works. The signer receives a unique link by email, is shown the full document, and confirms with a one-time code sent by SMS. The code has a limited validity period and a limited number of attempts. The link is invalidated once the signature is complete, or if the document is withdrawn.

Legally. Agreements between businesses are, as a starting point, not subject to formal requirements under Danish law, and under the eIDAS Regulation an electronic signature cannot be rejected solely because it is electronic. What decides a dispute is therefore the quality of the evidence: can it be documented who accepted what, when, and that the document has remained unchanged since.

Signing with an SMS code corresponds to a simple electronic signature within the meaning of the eIDAS Regulation. Together with the audit trail, it provides documentation of how the agreement came about.

When it needs to carry more weight. MitID can be selected per contract if the counterparty needs to be identified more strongly, including MitID Erhverv (Business), which ties the signer to the company. This is relevant for higher-value agreements, or where there is doubt about who can bind the counterparty.

We don't promise validity. We provide the platform and the documentation, but we cannot guarantee that a specific signature will be recognized by a court or counterparty in a given case. No vendor can. What we do guarantee is that events are recorded and preserved as described here — and that you can always choose a higher level of identification where the agreement warrants it.

Encryption

All data is encrypted in transit with TLS. HTTPS is enforced on all endpoints.

Data is encrypted at rest with AES-256. This applies to the database, file storage and backups alike. Sensitive values such as access tokens and keys are additionally encrypted at the application level before being stored.

Integration keys and other secrets are stored encrypted, scoped to the environment they belong to, and can be rotated or revoked without redeploying the system.

Backup and recovery

The database is backed up daily, and it's possible to restore to any point in time within the retention window.

We test restoration, so backup isn't just a setting but something we know works.

You're not dependent on our backup to have your documents: all signed contracts can be downloaded as a PDF with an audit trail at any time, and the entire archive can be exported. We recommend you keep signed agreements in your own archive, regardless of which contract system you use.

Retention and deletion

While you're a customer, your data is retained for as long as you want. You can delete individual documents, individual users and entire workspaces at any time.

Internal comments are permanently deleted once a contract is sent for signature for the first time. They cannot be restored.

When the subscription ends, you have 30 days to export everything yourself, including signed documents with audit trails. After that we delete your data no later than 90 days after termination, including at our sub-processors. We document the deletion if you ask us to.

Our own records about your users — name, work email, role and activity log — are deleted or anonymized no later than three years after the customer relationship has ended. Accounting records are kept for five years, as required by law.

We do not use your contracts to train AI models. The content is processed to deliver the features in your own system and for nothing else.

Sub-processors

We use the following suppliers to deliver the service. The full list with processing location and nature of processing can be found in our data processing agreement.

• Lovable — hosting, database, file storage, authentication and server functions. EU region.
• Supabase — the underlying database platform. EU region.
• Amazon Web Services — the physical infrastructure. EU region.
• Mailgun — sending email. EU region.
• Twilio — sending SMS with one-time codes.
• AI provider — processing of document text when using the system's AI features.
• Payment provider — invoicing and payment.

Changes to the list are announced with 30 days' notice to the contact person you have registered, and you can object before the change takes effect.

HubSpot, monday.com, Float, Slack and Google Workspace are not our sub-processors. If you activate an integration, data is sent to your own account with that provider on your own instruction.

Shared responsibility

Security is shared between us and you, and it's worth being precise about where the line is.

We are responsible for the platform's security: hosting, encryption, access control in the database, audit trail, the signing flow, backups and choice of sub-processors.

You are responsible for who has access on your side, ensuring users are removed when they leave, that contracts are sent to the right people, that the content of your agreements is correct, and that you have a legal basis for processing the personal data you put into the system.

Our suppliers hold SOC 2 Type II and ISO 27001 certifications. That does not make Todai Contracts certified — a certification at a sub-processor covers their platform, not ours. We say this because a number of vendors are imprecise on exactly this point.

How we work with this. Automated security scans of database configuration and access policies run on every release, and deeper reviews of the entire codebase are carried out at regular intervals. We have automated tests that attempt to access data across customers and roles, and these run every time the system changes.

Data processing agreement

Our data processing agreement follows the Danish Data Protection Agency's standard structure and applies automatically to all customers. It contains information about the processing, the full list of sub-processors, the instructions and the technical and organizational security measures.

The agreement is an integral part of the terms and is accepted when a subscription is created. No separate signature is required.

If you need an individually signed copy for your own archive, we're happy to send it for signature. Write to us.

Contact for security inquiries

Found a vulnerability? Write to security@todai.ai. We confirm receipt within two business days and follow up with an assessment. We welcome reports from security researchers and will not pursue responsible, non-destructive testing that does not access other people's data. Please don't test against production with real customer data — write to us first and we'll find another way.

Questions about data processing, GDPR or access requests: privacy@todai.ai

Vendor assessment or security questionnaire: privacy@todai.ai. We answer questionnaires and can, by agreement, provide further documentation.

Todai A/S · CVR 41776641 · Olivia Hansens Gade 3, 2nd floor, 1799 Copenhagen V, Denmark