Security at Draftable
Built for documents you cannot afford to get wrong.
Draftable is used by law firms, corporate legal teams, and regulated businesses to compare and clean documents that are confidential, privileged, or commercially sensitive. Our security program is built around the high standards our customers expect of us.
We’re independently certified
Draftable is part of Affinda Holdings Ltd. Our Information Security Management System is independently certified and covers the Draftable brand across our cloud services and software our customers run on their own infrastructure.
ISO/IEC 27001:2022 certified Information Security Management System
SOC 2 Type II attestation covering the Trust Services Criteria for Security
Independent penetration testing of our web application and API
Certificates and reports are published in our Trust Centre
Security for Draftable Compare and Draftable Clean
Draftable API Security
Draftable’s free comparison tool security
How we protect your data
Encrypted in transit and at rest
TLS 1.2 or 1.3 for everything in transit, AES-256 at rest. Legacy protocols and weak ciphers are prohibited by policy, not just discouraged.
Access is controlled and logged
Least-privilege access, multi-factor authentication, and logging of all access to customer data.
Built securely
A formal Software Development Life Cycle covering code review, change management, and security testing.
Resilience
Hosted on AWS with encrypted daily backups, documented and tested business continuity and disaster recovery plans, and object storage designed for 99.999999999% durability.
Responsible disclosure
We welcome reports from the security community and operate a responsible disclosure programme with safe harbour for good-faith research. How to report a vulnerability
Full documentation
Our Trust Centre holds our current certificates, attestation reports, and policy documents.
Your documents never reach us at all
The most important thing to understand about Draftable security is that most of our products never receive your documents. We only get your documents if you specifically want to share them with us, like for support or diagnostic reasons. We never get documents without your permission.
Draftable Compare
Runs on your own machines. Comparison happens locally.
Draftable Clean
Runs on your own machines. Metadata cleaning happens locally.
Draftable API Self-Hosted
Runs entirely on your own infrastructure.
Draftable API
Cloud-hosted, and you control the lifecycle of everything you submit.