Security and data protection

1Where the data is kept

The database, sign-in and files are on the Supabase platform, which runs in Amazon Web Services' Frankfurt data centre (eu-central-1). User accounts, saved profiles, contract data, reusable contracts and uploaded templates are kept there.

The website and server-side processing run on the Vercel platform. Requests that read or change your data are processed in a European Union region. Public pages (such as this one) may be served from the data centre nearest to you for speed.

Outside the European Union the contract text travels only when it is processed by artificial intelligence (see “Artificial intelligence” below).

2Encryption

In transit: all traffic between your browser, our servers and our service providers goes over HTTPS (TLS). The site does not allow unencrypted connections.
At rest: Supabase encrypts all database data and files on disk with the AES-256 algorithm. The same applies to Vercel, Stripe and Resend.
Passwords are stored only as a one-way hash. We cannot see your password or give it out to anyone. When you sign in with Google, no password is created with us at all.

3Who can access the data

Your contracts, profiles and files are tied to your account and visible only to you when signed in. In addition to the application's own checks, we use database-level access rules (Row Level Security). They limit which rows a signed-in user's query can see at all, even if there were a bug in the application code.

Files (uploaded templates and previews) are in private storage buckets that have no public address. They can only be accessed through our server, after the permissions have been checked.

The database key with full privileges is only on the server and never reaches the browser. It is used only for operations a user cannot perform themselves, such as the nightly clean-up of expired links.

4Shared links

When you send a contract to the other party to fill in, they get a link by e-mail. The link's security is built like this:

Every link contains a randomly generated 256-bit secret key. It cannot be guessed.
We store only a hash of the secret key (SHA-256), not the key itself. Even someone with a copy of the database could not work a valid link back out of it.
Links expire. A co-filling link is valid for 30 days. For a reusable contract link you choose the validity yourself: 3, 7, 14 or 30 days.
A reusable contract link can be revoked before it expires.
Every night the previews belonging to expired, revoked or already completed links are deleted automatically.
Public links are rate-limited so that links cannot be tried out en masse. The limit does not store the IP address, only a keyed hash of it.

A link gives access only to that one contract. Send it only to the person the contract is meant for.

5Payments

Payments are processed by Stripe. You enter your card details in Stripe's payment window and they never reach our servers. We see only the payment reference, the amount and the status. Stripe is certified under the highest security standard for card payments (PCI DSS Service Provider Level 1).

6Artificial intelligence

Drafting the contract text, the contract check, filling in your own template and form suggestions use OpenAI's service. For this, the contract text is sent to OpenAI together with the details you entered in the form. Drafting contracts is the core of the service, so the details of every contract created travel to OpenAI this way.

OpenAI's servers are in the USA. The transfer is based on the European Commission's standard contractual clauses.
OpenAI does not use data sent through its API to train its models.
OpenAI may keep requests for up to 30 days to detect misuse, unless the law requires longer retention.

If a document contains data you do not want sent outside the European Union, do not use the contract check or own-template filling for that document.

7Service providers and their certifications

We use well-known service providers that have had their security controls reviewed by an independent auditor. These certifications apply to the service providers, not to Lepinski.

Supabase — database, sign-in, files. Location: EU (Frankfurt). SOC 2 Type 2, ISO 27001.
Vercel — web hosting and server-side processing. Location: EU. SOC 2 Type 2, ISO 27001.
Stripe — payments. PCI DSS Service Provider Level 1, SOC 1 and SOC 2 Type II.
OpenAI — drafting and checking the contract text. Location: USA. The API service is SOC 2 Type 2 compliant.
Resend — e-mails (confirmations, invitations, newsletter). SOC 2 Type II.
Google — sign-in only, if you choose a Google account.

SOC 2 Type 2 means that an independent auditor has checked whether the security controls actually worked over a longer period. ISO 27001 is the international standard for information security management.

8Visitor statistics

We use Vercel's cookie-free visitor statistics, which do not identify individual visitors. Before statistics are sent, personal links and payment references are removed from the addresses, so no working sharing link ever reaches the statistics.

9Keeping and deleting data

We keep account data for as long as the account exists. You can download and delete saved profiles yourself on your profile page. To delete your account, write to tugi@lepinski.ee. The exact retention periods are in the privacy policy.

10Reporting a security vulnerability

If you find a security vulnerability in Lepinski, please write to tugi@lepinski.ee with the subject “Security vulnerability”. Include a description of how to reproduce the bug and, if possible, its impact. We will confirm receipt and let you know how the fix is progressing.

We ask you:

not to disclose the vulnerability before we have fixed it;
not to view, change or delete other users' data more than is strictly necessary to demonstrate the bug;
not to overload the service or use automated mass requests.

We take no legal action against a reporter acting in good faith. We do not currently have a paid bounty programme. The contact details are also available in machine-readable form at /.well-known/security.txt.