Where your data lives and how it’s protected
Renewly is built solo, so this page exists to answer a simple question directly: what actually protects your contract data, and what happens if something goes wrong — including if something happens to the person running Renewly.
How you sign in
Renewly uses email and password to sign in, with an optional extra step called two-factor authentication (2FA) — a 6-digit code from an authenticator app, checked in addition to your password. You can turn this on from Settings → Security.
We don’t currently offer single sign-on (SSO), “Sign in with Google,” or passkey/fingerprint login. If any of these are a requirement for your organization, tell us — it helps us prioritize.
How your data is separated from every other customer's
Every request Renewly’s servers make to the database is scoped to your organization specifically — the application code is written so that a query for “your contracts” can only ever return rows that belong to your organization. This is enforced consistently across the entire codebase, not on a page-by-page basis.
As an additional backstop, the large majority of Renewly’s database tables also have row-level security turned on, which blocks any attempt to reach customer data through the database’s separate public API — a second lock on a door that shouldn’t be reachable in the first place.
Encrypted in transit, private by default
Email + optional 2FA
Sign in with email and password, with an optional authenticator-app code checked in addition.
Private, expiring file links
Documents sit in a private bucket. Every view uses a link that expires after one hour — nothing is permanently public.
Encrypted everywhere
All traffic between your browser and Renewly runs over HTTPS/TLS, as standard for any modern web app.
Where your data is hosted
Renewly currently runs as a single-region service. We don’t yet offer a choice of hosting region (e.g. EU vs. US) — this is on our radar as we grow, but isn’t available today. If data residency is a hard requirement for you, let us know.
Who processes your data
Renewly is a small team, which means we rely on established infrastructure providers rather than running our own servers. Here's exactly who touches what.
| Provider | What they do | What they see |
|---|---|---|
| Supabase | Database, authentication, file storage | Your account data, contracts, and extracted contract data |
| Vercel | Hosts the application | Runs the code that processes your requests |
| Anthropic (Claude) | Reads and extracts key terms from your uploaded contracts | Full contract document text, sent for processing. Anthropic's own retention terms apply. |
| OpenAI | A smaller classification step, and our original extraction pathway | A short excerpt of document text for classification, and up to the first 15,000 characters of text for some non-contract documents. OpenAI's own retention terms apply. |
| Paddle | Billing and subscriptions | Billing details — checkout runs on Paddle's own hosted page, so Renewly does not handle your raw card details |
| Zoho | Sends transactional emails (alerts, notifications) | Your email address and the content of the email being sent |
| Mailgun | Powers the Renewly Inbox forwarding-address feature | Forwarded vendor emails and attachments, for organizations using this feature |
| Slack | Optional integration to post contract alerts to your workspace | Contract alert content, only if you connect this integration |
| QuickBooks | Optional integration to sync vendor/expense data | Vendor and expense data, only if you connect this integration |
| Sentry | Error monitoring, so we can catch and fix bugs quickly | Technical error details — we've done dedicated work to strip request bodies, cookies, and tokens out of what our server-side error monitoring receives |
We use two different AI providers (Anthropic and OpenAI) at different stages of contract processing — this table names both, deliberately, rather than simplifying to one.
Audit logs, exports, and account deletion — the honest version
Platform-level actions (things Renewly staff do, like account suspensions) are logged in a dedicated audit trail.
Everyday actions you take — uploading a contract, deleting one, changing a team member’s role — are not currently captured in a customer-facing audit log. The one exception is login activity, which is tracked and viewable in Settings → Security.
Exporting your data: you can export your contract list as a CSV file at any time, directly from the Contracts page. This covers the core contract fields (name, vendor, status, dates, value). A full export of everything Renewly holds about you — including every extracted field and your account history — isn’t yet a self-service feature; request one any time by emailing us and we’ll prepare it.
Deleting your account: this is currently a manual process — email support@renewly.net and we’ll process the deletion. It isn’t yet a one-click, self-service action inside the app. Deletion removes your organization’s contracts, stored documents, extracted data and login records. We keep billing records and internal support logs where needed.
We’re telling you exactly where the self-service line sits today rather than implying more automation exists than actually does.
Certifications
Renewly does not currently hold SOC 2, ISO 27001, or any other formal security certification. We’re a young, solo-founder company, and pursuing formal certification is a meaningful undertaking we haven’t yet taken on. We’d rather tell you this plainly than use vague language that implies otherwise.
If a specific certification is a hard requirement for your procurement process, please reach out — we want to know what’s actually needed rather than have you find out too late that we don’t have it.
Review the details that matter to your team
Review the collection and use of personal information and contract data.
Use a practical checklist for sources, uncertainty, and human review.
Contact Renewly about requirements not covered on this page.
Questions we haven't answered here?
If something about how your data is handled matters to your decision, ask us directly — we'd rather answer it now than have it surface later.