Security
How we protect your jobs, contracts and filings.
What is actually running today, including the gaps. We update this page when anything changes.Last updated September 18, 2026
US storage
Database, backups and files stay in the United States.
No AI training
Your content is never used to train AI models.
Backups and undo
Three independent backups and a 30-day undo for deletes.
Encrypted sessions
TLS everywhere and an HttpOnly session cookie.
Not legal advice. Nothing on this page is legal advice or a warranty of any particular outcome. LienShield is a document preparation service, not a law firm.
Data protection
- Encryption in transit
- All web and API traffic is TLS 1.2 or higher; current browsers negotiate TLS 1.3. Both lienshield.app and api.lienshield.app send Strict-Transport-Security: max-age=63072000; includeSubDomains; preload.
- Encryption at rest
- Storage-layer encryption provided by our hosts: the Railway PostgreSQL volume and its backups, and Cloudflare R2, which encrypts objects at rest by default. LienShield does not add an application-level encryption key on top of that, so individual database fields are not separately encrypted.
- Password hashing
- Bcrypt via the bcrypt library's gensalt() default, which is a cost factor of 12 today. We rely on the library default rather than pinning the number ourselves. Plaintext passwords are never logged, returned, or stored.
- Authentication
- A JWT access token with a 30-minute lifetime, delivered in an HttpOnly + Secure + SameSite=Lax cookie whose Domain attribute is restricted to lienshield.app. No long-lived refresh token is issued and there is no refresh endpoint, so a session simply ends after 30 minutes and you sign in again.
Infrastructure
- Backend hosting
- Railway, US East region (Virginia). FastAPI + Uvicorn behind Railway's edge proxy.
- Frontend hosting
- Vercel global edge network, for the website and dashboard code only. Your project data never passes through it: your browser sends it straight to our API.
- Object storage
- Cloudflare R2, in a bucket created under Cloudflare's United States jurisdiction, which guarantees stored objects stay in the US. Holds the contracts and evidence files you upload. Object keys are namespaced by project (evidence/{project_id}/...); access is authorized per request against your organization rather than by the key path.
- Database
- Managed PostgreSQL 17 on Railway, single instance, in the same US East region.
- Data residency
- All customer data is stored in the United States: the database and its backups (Railway, US East), uploaded files and the off-site backup (Cloudflare R2, US jurisdiction). AI processing runs on Anthropic's US-only infrastructure and billing on Stripe in the US. One exception: the emails we send you (verification, reminders, reports) are delivered through Brevo in the EU, so each email's content passes through the EU. The website's page code is served from a global edge network and carries none of your data.
Backups and recovery
- Continuous backup
- Point-in-time recovery on the production database: every change is archived within about a minute, so the database can be rebuilt as of any moment in roughly the last four weeks. The archive is stored in the US.
- Snapshots
- Automatic database snapshots daily (kept 6 days), weekly (kept about a month) and monthly (kept about three months).
- Off-site copy
- Every night, a consistent copy of every table is exported to separate storage with a different provider (Cloudflare R2, US jurisdiction), with a checksum for every file. Daily copies are kept 35 days and one copy per month for 12 months, so the data survives even the loss of the hosting account.
- Tested restores
- A backup is only real if it restores. On September 18, 2026 we restored the nightly copy into an empty database and every table matched the original row for row.
- Undo for deletes
- Deleting a project or an evidence file moves it to Recently deleted for 30 days, where a manager can restore it with all of its filings, documents and files. Nothing is permanently removed before then.
- Append-only audit record
- Uploads, downloads, deletes, restores, filings and their status changes, role changes, invitations and project edits are written to an audit record the application only ever adds to. No screen or API edits or removes an entry, and the data layer refuses an attempt to do either. Each entry is stamped with the database server's own clock as it is written, and nothing accepts a timestamp from the caller. Entries are removed only if the organization itself is deleted, which removes its data with them.
- Unsaved work
- A new project you are entering is saved in your browser as you type, so a closed tab or an expired session doesn't lose it. The draft is cleared when you save the project or sign out.
Application hardening
- Content Security Policy
- API responses ship "default-src 'none'; frame-ancestors 'none'" so the surface can't be embedded or fetched from a foreign origin. The web app ships its own CSP with an explicit script-src and connect-src allowlist.
- CORS allowlist
- An explicit list of allowed origins, with credentials and no wildcard. Every state-changing request is also rejected if its Origin header is not on that list.
- Rate limiting
- Per-IP limits on authentication, registration, password reset, contract parsing, exports, filings and other quota-bound endpoints. Counters are currently held in each instance's memory rather than in a shared store, so they reset on restart. A shared store and multi-IP credential-stuffing detection are on the roadmap.
- Security headers
- X-Content-Type-Options: nosniff, X-Frame-Options: DENY, Referrer-Policy: strict-origin-when-cross-origin, and Permissions-Policy: camera=(), microphone=(), geolocation=() on API responses, alongside HSTS and the CSP above.
- Multi-tenant isolation
- Every tenant-scoped query filters on organization_id at the ORM layer, with per-route role assertions on top. This is application-level enforcement — PostgreSQL row-level security is not enabled, and it is on the roadmap.
Privacy and access
- No data sale
- We do not sell your data, and your projects, contracts, filings and files are never used to train AI models, whether ours or our AI provider's.
- AI processing
- Contract auto-fill (what you upload, up to 5 files in one upload — up to the first 60,000 characters of each text document and no more than 120,000 characters in total across one upload, or the file itself if you upload a photo, a screenshot or a scanned PDF) and the automatic review of each generated document (the filled form fields) run on Anthropic's Claude API, with every request pinned to Anthropic's US infrastructure. Auto-fill runs only on a contract you choose to upload, and every field can be typed by hand instead; the review runs on each document you generate. An organization admin can turn both features off for the whole organization in Settings, under “AI & your data”; while they are off nothing from that organization is sent to Anthropic, and the rule-based checks on every filing carry on as usual. Anthropic's API terms state that data is never used for model training without the customer's express permission, which we have not given, and that it deletes inputs and outputs within 30 days of receipt or generation (trust-and-safety and legal exceptions are in Section 3 of the Privacy Policy). A file you drop into auto-fill is also saved to that project's evidence vault unless you untick that at the review step; files you add to the vault yourself are never sent to Anthropic. Deadlines are calculated by rules, never by AI.
- Subprocessors
- Railway (hosting + database), Vercel (frontend), Cloudflare (DNS + R2 object storage), Stripe (billing), Brevo (email delivery, EU), Anthropic (contract auto-fill and document review), Google Ads (conversion measurement), and Vercel Web Analytics + Speed Insights (public pages only). The Privacy Policy lists what each one receives and where.
- Data export
- CSV and Excel exports of your projects, filings, deadlines and evidence are available from the dashboard on every plan tier, to organization owners and managers.
- Account deletion
- Email support@lienshield.app from the address on the account. Deletion is handled manually — there is no self-serve deletion control in Settings today — and our target is to complete it within 30 days, subject to billing records we are required to keep and to recorded lien filings, which are public records we cannot retract.
Compliance posture
- SOC 2 status
- SOC 2 Type II readiness is on the 2026 roadmap. We document control activity (access reviews, change management, encryption, monitoring) ahead of the formal audit. We are not certified today and we do not claim our vendors' certifications as our own.
- GDPR / CCPA
- We respond to access, export and deletion requests sent to support@lienshield.app, handled manually rather than through a self-serve privacy console. We do not yet operate a cookie-consent banner and do not yet honor Global Privacy Control signals; the Privacy Policy states exactly what loads and how to opt out.
- PCI
- Payment cards are entered on Stripe-hosted pages and processed exclusively by Stripe; LienShield never sees or stores card numbers.
Vulnerability disclosure
If you believe you've found a security issue affecting LienShield, email security@lienshield.app. We acknowledge reports within one business day and fix verified issues on a priority schedule. Please do not exploit an issue, access other customers' data, or run automated scans that degrade the service.
In scope: lienshield.app, *.lienshield.app and the LienShield web app. Out of scope: social engineering, physical attacks, denial of service, and third-party services that host our subprocessors.
Reviewing LienShield for your company?
We can answer security questionnaires and walk through the subprocessor list, backups and access controls with your team. The Privacy Policy lists every subprocessor and exactly what it receives.
Put every lien deadline on one calendar.
Start free, add your first job, and see every notice, lien and lawsuit deadline for your role, each tied to the statute it comes from.
Free plan available. No credit card required.