Security

Built for teams that can't take chances with sensitive contracts.

Your leases carry proprietary terms and confidential pricing. This page describes how Acrebase handles them, in the same detail whether you are a two-person legal team or a portfolio-wide leasing program.

Encryption

AES-256 for documents in transit and at rest.

Single sign-on

SSO through your identity provider, including Okta and Microsoft Entra, on Enterprise plans.

Granular permissions

Control who sees what, by deal, by role, by document.

Audit logs

Every action recorded and attributable, including every AI action.

Data agreements

Data processing agreements in place with the AI providers we use.

Penetration testing

In-house security team runs ongoing penetration tests and vulnerability assessments.

AI data handling

What happens to a document when the model reads it.

Acrebase uses large language models to read redlines, extract deal points, and draft edits. These are the rules every one of those calls follows.

  • Data processing agreements with every model provider we send documents to.
  • Documents and prompts encrypted in transit and at rest.
  • AI access inherits the user’s permissions. If you cannot open a document, neither can a prompt you write.
  • Every AI action is recorded in the audit log with who asked, what was read, and what changed.
  • Output is checked, not assumed. The team’s background is in measuring whether a model’s answer is correct.
Audit logs

Every action, attributable.

Who viewed a round, who accepted a change, what the system filed on its own, and who let outside counsel in. Retained for the life of the workspace, longer on Enterprise plans.

Compare plan controls
Audit log — Seaside Gelato negotiation Live
R. Alvarez viewed Round 3 9:42 AM
M. Chen accepted 4 changes · redline scan 9:47 AM
System filed forwarded email to Round 2 9:51 AM
R. Alvarez granted view access to outside counsel 10:03 AM

Need the documentation before the demo?

Request our security documentation and we will send it ahead of the call, along with a DPA for review.