Built for the trust-sensitive
part of the relationship
Onboarding touches contracts, client data, and account access, the most sensitive moment of the relationship. AutoStack treats security as a product surface, not a footnote.
Tenant isolation
Row-level isolation keeps every workspace's data strictly separated. Tenant context is bound to the authenticated session, never trusted from the client.
Least-privilege access requests
Integrations use OAuth authorization-code with PKCE, minimal scopes, encrypted token storage, and revocation on disconnect.
Secure file handling
Uploads are validated by type and scanned, stored outside the web root, and served through expiring signed URLs.
Immutable signed documents
Executed agreements are stored write-once with content hashing and evidence, a tamper-evident legal record.
Audit logs
Append-only, access-restricted audit events across the workflow (who did what, and when) for forensics and trust.
Otto guardrails
Otto is ACL-aware and retrieval-grounded. It never mixes internal-only data into client-facing output, and never sends contracts or grants access on its own.
Compliance on the roadmap
SOC 2 Type II readiness is a sequenced priority. AutoStack supports GDPR and CCPA workflows (DPAs, subprocessor transparency, retention rules, and deletion requests), plus Canadian data residency and accessibility (WCAG / AODA) for public-sector deployments.
Security questions, answered
Have a security questionnaire?
Tell us about your requirements (SSO, data residency, retention, or audit exports) and we'll walk you through it.