Security

Reporting a vulnerability

Email hello@thecompound.tech. Include the URL, what you did, and what you saw. There is no bounty and no NDA to sign. We will confirm receipt, and we will tell you what we changed.

The same address, with a machine-readable expiry, is published at /.well-known/security.txt under RFC 9116.

Accounts

ClauseWatch has user accounts. What is stored against one, and who else touches it, is below.

What is stored

• Your account: the email address you sign in with, and the Google Drive folders you connect if you connect any
• The contracts you upload or authorise, and the dates, parties and notice windows the agent reads out of them — this is the product
• Every notice the agent drafted and every decision you made on it, because that record is what makes the kill window provable rather than asserted
• Anonymous usage analytics — page views and clicks. Form inputs are masked in session recordings

Who else processes data

• Supabase — authentication and the database holding your contracts, their dates and your decision history
• Google Drive — where a contract is read from, under exactly the access you granted and no more
• Stripe — takes the subscription payment and holds the card details — we never see a card number
• PostHog — anonymous product analytics, proxied through this domain
• Vercel — serves this site and holds its access logs

Also true

• The plans are STANDARD at $5/month and TEAM at $15/month. There is no free plan. The live demo at /demo needs no card.
• A contract you upload is read for its dates and parties. It is not sent anywhere else, and no notice leaves your name without you approving that specific message.
• Every action the agent takes is written to an append-only ledger with the evidence it acted on, including the ones nobody looks at. That record is what makes the kill window provable rather than asserted.
• There is no password on this product. Sign-in is a link sent to your email address, so there is nothing to reuse, leak or reset badly.
• Your data is scoped to your organisation at the database level, not only in the interface.

ClauseWatch is built and run by Compound Labs. The declarations on this page are part of this product's own configuration and are re-checked at every deploy against the repository they describe: a product that claims to have no accounts and ships an authentication route fails the build, and so does one that takes payment without naming its payment processor here.