Contract tracker security checklist

• Matter membership gates every document and search query in RLS; confidential matters are invisible to non-members including admins unless explicitly added, and ethical walls are enforced as membership exclusions.

• Privileged and client-confidential content is encrypted at rest, not included in logs or analytics, and every view or download of a confidential matter is audited.

• Signing links are single use, expire, are bound to the exact document hash and signer, and rate limited; replay or tampering of the document invalidates the request.

• Documents are limited to approved types and size, scanned for malware, macro-enabled formats are rejected, and previews are rendered server-side from a safe converter.

• Executed versions and certificates are immutable; amendments are new versions; every approval is tied to a specific version and invalidated by any edit.

• Invoice payment webhooks are signature verified and idempotent; client funds and trust accounting are not handled by the app.

• Electronic signature law (applies to e-signature): ESIGN/UETA and eIDAS recognise simple electronic signatures for most contracts but some documents need advanced or qualified signatures or wet ink; phase 1 provides simple signatures with evidence only.
• Professional rules and privilege (applies to law firms): Law firms have duties on confidentiality, conflicts and client funds; the app supports conflict search and ethical walls but does not replace professional compliance.
• Records retention and legal hold: Retention periods and holds are legal decisions set by counsel; the app enforces the configuration.
• Data protection (applies to personal data): Contracts contain personal data; apply minimisation, access logging, retention and cross-border transfer controls.

• email per org day: daily outbound email ceiling per organisation, fails closed.
• extraction pages org day: daily extraction page budget per tenant.
• storage gb per org: per-tenant document storage quota.
• ocr pages per org month: monthly OCR page ceiling when OCR is enabled.

Forge64 gives every app its own Postgres database and runs a quality gate that flags unauthenticated writes and secrets in client code before you see the app. It does not replace your own testing, and it holds no third-party security certification today.

This is a reference design for the category, not a promise that every item is generated today. Built-ins such as background jobs, file uploads and search are rolling out; email sent from your app is coming soon, so anything here that needs it is something you add yourself for now.

• Sign in as two different users and try to open each other's records by changing the id in the address.
• Submit each form with an empty value, a very long value and a script tag, and check the result.
• Call each write endpoint without signing in and check that it refuses.

What is the biggest security risk in a contract tracker?

Matter membership gates every document and search query in RLS; confidential matters are invisible to non-members including admins unless explicitly added, and ethical walls are enforced as membership exclusions.

Does a contract tracker have compliance obligations?

Electronic signature law, if you have e-signature: ESIGN/UETA and eIDAS recognise simple electronic signatures for most contracts but some documents need advanced or qualified signatures or wet ink; phase 1 provides simple signatures with evidence only. This is a starting point, not legal advice.

Will Forge64 certify my app as secure?

No. Forge64 holds no third-party security certification today and does not certify apps. The checklist is a way to test your own app.

• How to build a contract tracker
• Contract tracker architecture
• Example prompt for a contract tracker
• Contract tracker scaling checklist
• Often combined: approval workflow app
• Often combined: compliance portal
• All app types