SOC 2 hosting and security controls

Renewly is hosted on SOC 2 Type II infrastructure (Supabase + Vercel). Renewly itself is not in audit scope - the certifications belong to our infrastructure vendors. On top of that infrastructure we apply the engineering controls described below.

For the full residency posture and sub-processor map, see /trust.

Field-Level Encryption

Sensitive contract fields are encrypted at rest using AES-256-GCM. This includes contact emails, phone numbers, payment details, and tax identifiers extracted from your contracts.

Encrypted fields include:

Vendor contact email and phone
Internal contact email
Payment details and bank accounts
Tax IDs and government identifiers

Data Retention Policies

The platform-wide audit log is retained by Renewly for 3 years for security and compliance. On top of that, organisation admins can set retention periods for the application-level records below. When data exceeds its retention period, it can be automatically deleted or flagged for review.

Contracts

Min: 30 days - Default: 1 year

Extraction Data

Min: 30 days - Default: 1 year

Notifications

Min: 30 days - Default: 90 days

The platform audit log is retained for 3 years and is not shortened by org-level retention settings.

Security Event Monitoring

All security-relevant actions are logged with severity levels. Events include sign-in attempts, 2FA changes, passkey enrollment and revocation, API key operations, data access, and permission changes.

Severity levels:

Info - Normal operations (logins, data access)

Warning - Failed logins, permission changes, key revocations

Critical - Suspicious activity, data deletion

Compliance Controls

Encryption at rest

All data encrypted via Supabase (AES-256). Sensitive fields have additional application-level encryption.

Encryption in transit

TLS 1.3 enforced on all connections. HSTS headers with 1-year max-age.

Access controls

Role-based access control (RBAC) with row-level security. Organisation-scoped data isolation.

Audit trail

Comprehensive activity logging with actor, action, timestamp, and IP address.

Authentication

Multi-factor authentication (TOTP), SSO/SAML, and OAuth 2.0 support.

Data minimisation

Configurable retention policies. Automatic deletion of expired data.

Managing Compliance Settings

Organisation admins can configure all compliance settings from the Settings page: