Trust Center · last updated 2026-04-19

Security you can explain in plain English.

Concord AI handles real contracts and personal information for businesses in insurance, finance, healthcare, and home services. We're built to meet the strictest U.S. and EU rules — ESIGN, HIPAA, SOC 2, GDPR, and more. Here's how we keep your data safe, in plain language.

Standards we meet

Concord AI is built to meet — or go beyond — the rules below. Enterprise customers can request audit reports and evidence under NDA from compliance@concordapp.ai.

ESIGN Act & UETA

Our e-signatures are legally binding in all 50 U.S. states. We capture the signer's consent and identity, and lock a tamper-proof audit trail into every signed PDF.

eIDAS (EU)

Meets the EU's Advanced Electronic Signature standard. We verify the signer, keep the signature under their control, and can prove if a document is changed after signing.

HIPAA

Built to safely handle protected health information for healthcare contracts. A signed Business Associate Agreement (BAA) is available on Enterprise plans.

SOC 2 Type II

Independently audited for security, uptime, and confidentiality. Audit in progress — we can share evidence with enterprise customers under NDA.

GLBA (Financial)

Meets the safeguards required for handling personal financial information: written security program, access controls, encryption, monitoring, and incident response.

NAIC (Insurance)

Aligned with state insurance data-security laws: risk assessments, vendor oversight, board-level governance, and 72-hour breach notification.

SOX (Public Companies)

The same person can't both create and approve a high-value contract. Every action is recorded in a permanent log, and template changes are tracked by version.

GDPR · CCPA · CPRA

We honor data-privacy rights — view, export, correct, or delete your data — within 30 days. EU customers can choose to keep their data in Europe.

PCI DSS

We never see, store, or process credit-card numbers. Any payments are handled by certified payment providers, not Concord AI.

How we protect your data

These eight protections aren't just promises in a policy — they're built into the database, the server, and the app itself.

Each customer's data is fully isolated

Every customer's data lives behind a database-level wall. Even if a bug got past our app, one customer could never see another customer's records.

Encrypted in transit and at rest

All traffic uses modern HTTPS. Your data, files, and backups are encrypted on disk with AES-256, and our keys rotate automatically.

Strong sign-in

We block known leaked passwords, require email verification, and offer single sign-on (SSO) and two-factor authentication on Enterprise plans.

People only see what they need

Sales reps and auditors see a clean, redacted view — no signing links, IP addresses, or signature images. Only admins see the full record.

Evidence captured by us, not the browser

When someone signs, we record their IP and device server-side (the browser can't fake it) and append it to a log that can't be edited or deleted.

Tamper-proof signed PDFs

Every signed PDF includes an audit certificate — who signed, when, from where, and a digital fingerprint that proves the contract hasn't been changed.

Signing links expire

Each signing link is unique, expires after 14 days, and stops working the moment it's used. For multi-signer contracts, the next link only generates after the previous person signs.

No self-approval

The person who creates a contract can't also approve it when the price is above your approval threshold — only a designated approver or admin can.

How we handle your data

We collect only what we need to make the product work, and we honor every data-rights request within 30 days.

What we keep, and how it's protected

  • Most sensitive — signed PDFs, signature images, and signing IPs. Locked down so only admins can see the full record, with every access logged.
  • Sensitive — client contact info, contract drafts, pricing. Limited to your team based on their role.
  • Internal — your workspace name and team list. Visible only to people in your workspace.
  • Public — our marketing site and this Trust page.

What we never collect

  • · Social Security Numbers
  • · Credit-card numbers or payment data
  • · Government IDs or biometrics
  • · Your browsing activity outside Concord AI
  • · Third-party advertising or tracking cookies

How long we keep things, and backups

Signed contracts are kept for 7 years by default — long enough to satisfy IRS and most state insurance and financial recordkeeping rules (you can adjust this for your workspace). Deleted records are held for 30 days in case you change your mind, then permanently erased. Backups age out on the schedule below.

  • · Restore to any point in the last 7 days
  • · Daily backups kept for 30 days
  • · Monthly backups kept for 12 months
  • · If something goes wrong: ≤ 5 minutes of data loss, ≤ 4 hours to restore

Where your data lives

By default your data is stored in the U.S. (Virginia). EU customers can request European storage (Ireland) instead. We won't move your data between regions without your permission.

Your data rights

You can view, export, correct, delete, or restrict use of your data at any time. Email privacy@concordapp.ai. We'll verify your identity before releasing anything.

Sub-processors

We notify customers at least 30 days before adding any sub-processor.

VendorPurposeRegion
CloudflareEdge hosting, DDoS protection, WAFGlobal
Supabase (managed Postgres)Primary database, file storage, authUS-East / EU-West
Resend / SES (configurable)Transactional email deliveryUS / EU
Google Cloud KMSEncryption key managementUS / EU

Vulnerability disclosure policy

We welcome reports from security researchers and customers. Please act in good faith and we will respond promptly and protect you under our safe-harbor terms.

How to report

Email security@concordapp.ai with a clear description, reproduction steps, the impact, and any suggested remediation. PGP key fingerprint available on request.

Response SLA

SeverityFirst responseStatus updatesTarget fix
Critical24 hoursevery 24h7 days
High48 hoursevery 72h30 days
Medium5 business daysweekly90 days
Low10 business daysmonthlybest effort

Safe-harbor

We will not pursue legal action against researchers who make a good-faith effort to avoid privacy violations, data destruction, and service disruption; access only the minimum data necessary; do not exfiltrate, retain, or share customer data; give us a reasonable remediation window (default 90 days); and do not violate any other applicable law.

In scope

  • · *.concord.ai (production)
  • · The signing flow (/sign/$token)
  • · Server functions and server routes
  • · Authentication, RLS, and role enforcement
  • · Audit log integrity

Out of scope

  • · Denial-of-service / volumetric attacks
  • · Social engineering of staff or customers
  • · Physical attacks on infrastructure
  • · Findings on third-party services we don't operate
  • · Self-XSS and missing headers without impact