Terms is an independent, open-source project by Family Office, a design firm led by Diego Segura. We are always sending contracts back and forth with our clients, our freelance collaborators, and our lawyers. We built Terms to make that infinitely faster and easier.
Terms is, for now, an independent project. It has not been SOC 2 audited, and we make no claims about the complete and total security of the project. You can investigate the source code for yourself. Below is every technology we rely on and the precautions we take so that your contracts stay safe and secure.
| Area | What we do |
|---|---|
| Hosting | The app runs on Vercel and is served over HTTPS only. Nothing is exposed on plain HTTP. |
| Database | Contracts live in a Postgres database on Neon, encrypted at rest and reached over TLS. Preview and local builds use a separate branch, so production data never leaves production. |
| Access | Sign-in is handled by Clerk with one-time email codes; there are no passwords for us to store or leak. A contract link is an address, not a secret: opening it requires signing in with an email address the sender listed. Every read and write is scoped to the account that owns the contract at the type level, so another tenant's contract reports as if it does not exist. |
| Signing | A signature records the typed name, consent, IP address, browser, and a SHA-256 hash of the exact text signed. When the last party signs, the document locks on the server and a certificate of completion records the audit trail. |
| AI drafting | AI drafting, document questions, PDF imports, and the email agent send relevant content to Anthropic's API. This may include attachments and documents retrieved within your permissions. AI attachments are configured to expire after 24 hours; saved records and other provider retention are described in our Privacy Policy. Connected agents can also retrieve contract content when you give them an API key, and create or edit your unsent drafts if you grant draft access; you can revoke their access in Connectors. Read the public API reference for authentication and endpoints. |
| Notifications go through Resend and carry the contract's title, the parties' names, and a link. The email agent also receives messages and attachments, and its replies can include contract summaries or excerpts. | |
| Payments | Subscriptions are handled by Stripe. Card details go to Stripe directly and never touch our servers. |