Security & Trust

Uploaded PDFs are private to the company account that owns the renewal. DueAtlas stores them outside the public web root, serves them only through authenticated routes, checks company access before download, and does not intentionally send PDF contents, renewal notes, vendor names, costs, or contract text to marketing analytics.

Renewal records, team users, uploaded PDFs, reminder logs, and record history are scoped to the company account that owns them. Team members can only see records for their own company through server-side access checks.

Renewals and PDFs use non-sequential public references instead of exposing raw database IDs. Server-side permission checks still decide whether the signed-in user can view the record or document.

Uploaded PDFs are stored outside the public web root and served through an authenticated DueAtlas route after company access is checked. Direct public file paths are not used for customer PDFs.

Document uploads accept PDFs up to 20 MB. DueAtlas checks the PDF header and MIME type and rejects PDFs that appear to contain scripts, automatic actions, embedded files, or rich media. Do not upload passwords, private keys, payment card numbers, malware, or files you are not allowed to store.

PDFs attached to the current renewal can be deleted from the record. When a renewal cycle is completed, the cycle snapshot preserves the related historical PDFs so the company can review prior terms later.

DueAtlas uses password hashing, secure session cookies, CSRF protection, rate limiting, email verification, password reset tokens, and security event logging to protect account access.

Authenticator-app two-factor authentication is available for accounts. DueAtlas administrative access requires it, and the permanent owner admin account cannot be downgraded through the admin panel.

Payments are processed through Stripe. DueAtlas stores plan, billing status, Stripe customer, and subscription references, but it does not store full payment card numbers.

Product emails use the configured DueAtlas sender domain for verification, invitations, password resets, reminders, digests, and security notices. DNS readiness checks are in place for MX, SPF, DKIM, and DMARC, but inbox placement can still vary by provider.

DueAtlas creates encrypted local backup generations containing the verified database and uploaded PDFs, and runs app health, queue, reminder, and maintenance checks. Local backups help with operational recovery, but they are not an offsite disaster recovery guarantee; keep your own exports of critical records when needed.

If you believe you found a vulnerability, suspicious account activity, exposed data, or a document access issue, email security@dueatlas.com with the account email, affected URL or record reference, steps to reproduce, and screenshots if useful. Do not include passwords or sensitive secrets in email.