SOW Data Security & Privacy

The short version

SOWaudit is built for IT consulting and professional services teams who review Statements of Work before they are signed. We know a SOW contains client names, pricing and scope you can't afford to leak, so this page describes exactly what happens to it — including the limits.

Encrypted in transit (HTTPS/TLS) and at rest
Never sold, and never used to train AI models
Only you can see your audit history
Delete a single audit or your whole account yourself, any time
Every vendor that touches your data is listed below, with what it receives

What happens to a SOW you submit

Your SOW (pasted, or uploaded as PDF/DOCX) travels over HTTPS to our server. Uploaded files are read in memory to extract the text and are not saved. The text is sent to Anthropic's Claude API for analysis, and the findings come back to you.

If you're signed in

The SOW text and findings are saved to your account so you can reopen past audits, compare revisions and re-download reports.

If you're not signed in (free run)

Nothing is saved to our database. The results live only in your browser tab and are gone when you leave.

Prefer not to include client names?

Tick Hide client names before analysis on the audit page and choose the names to hide — SOWaudit suggests the client, vendor and contact names it spots in the SOW (found in your browser; nothing is sent), and you can add any it missed. SOWaudit swaps each one for a placeholder like [CLIENT] or [VENDOR] before the analysis runs, so the AI and your saved audit only ever see the placeholders. Your results show the real names back to you on your own screen. The list of names you hide stays in your browser and is never sent to us. Pasted text is swapped in your browser, so the names never leave it; an uploaded file is read on our server to pull out its text (which is not stored), and the names are swapped out before anything is analyzed or saved.

A few limits, so you know exactly what you get: only the names on your list are hidden, matched by exact text, so add short forms and spellings (“Acme” and “Acme Corp”) and use Preview what will be sent to check; images and logos in an uploaded file are never read or sent, because only the text is extracted; exports and share links keep the placeholders; and on another browser or device your history shows the placeholders, because the names were never stored with us. The risk analysis looks at scope, assumptions, pricing structure, acceptance and change control — it doesn't need to know who the parties are.

Who processes your data

These are the only third parties involved in running SOWaudit, and what each one receives. Certifications are as published by each provider.

Provider	What it does	What it receives
AnthropicSOC 2 Type II	AI analysis (Claude API)	SOW text, to generate findings. Anthropic does not train models on API data by default and keeps API inputs only for a limited period under its commercial terms.
NeonSOC 2 Type II	Database	Your account, saved SOW text and findings. Encrypted at rest (AES-256).
RenderSOC 2 Type II	Application hosting (with Cloudflare at the network edge)	All traffic to the app, encrypted with TLS.
StripePCI DSS Level 1	Payments	Your email and payment details. We never see or store card numbers.
SentrySOC 2 Type II	Error monitoring	Technical error details only. Request contents (including SOW text) and login tokens are stripped before anything is sent. Kept 30 days.
Resend	Account emails	Your email address and the emails we send you (e.g. welcome, audit complete).
Loops	Product update emails	Your email address and name. Unsubscribe from any email.
Google Analytics, Reddit, HeyCatch	Website analytics	Page views and button clicks. The SOW input and audit results are excluded — these tools never receive SOW content or findings.

Account security

Passwords are hashed with scrypt — we can't see your password
Sign-ins expire after 30 days, and signing out ends your session on our servers, not just in your browser
Changing your password signs out every other device
Repeated failed sign-in attempts are blocked
Every account that can reach production systems (hosting, database, payments, code) is protected with two-factor authentication

Who can see your SOWs

Your audit history is visible only to your signed-in account
Shared report links (Boss Links) are read-only, can't be guessed, expire after 30 days, and can be revoked. They show findings, never your SOW text
SOWaudit is founder-operated. Database access is limited to the founder's two-factor-protected account and is used only to keep the service running or when you ask for help — we don't read customer SOWs

Retention & deletion

Saved audits are kept while your account is active, so your history is there when you need it.

Delete one audit from your history: the SOW text, findings, exports and any remediation report are permanently deleted
Delete your account from account settings: your account, projects, exports, remediation reports and sessions are deleted. SOW text and findings are wiped from any remaining audit records; we keep only anonymous counts (such as how many risks of each severity were found) for product metrics
Database backups roll off within 6 hours, and error logs within 30 days
Stripe keeps billing records it is legally required to keep. To be removed from our email providers as well, email us and we'll handle it

We do not sell your data

SOWaudit does not sell, rent, or share your data for marketing or any other commercial purpose. The providers above receive only what they need to operate the service.

For procurement & security reviews

SOWaudit relies on SOC 2 Type II–certified providers for hosting, database and AI processing. SOWaudit itself is not yet independently audited (SOC 2). If your team needs a security questionnaire completed or has specific requirements, contact us — we'll answer plainly.

Questions or concerns

Security question, data request, or a vulnerability to report? Reach out directly.

Terry Reese — Founder, SOWaudit

Email: terry@sowaudit.com

We respond to all security inquiries within 1 business day.