Security
Your contract records, kept to the right people
NEC records hold commercial positions, so here is how they are protected. We describe the protections rather than the mechanics, because that detail would only help someone trying to get past them.
Each company kept apart
Your data is kept apart from every other company's. The whole app has been reviewed for this. Your own contractors see only what they are entitled to on the contracts they are on.
Checked on the server
Every action, edit and file deletion is checked on the server, not just by hiding a button. Permissions are enforced for the right side of the contract, and viewers are strictly read only.
Drafts stay private
A draft and its files stay within the company writing it until it is sent. The client side's private programme notes never reach the other party.
Getting into an account
Two-factor authentication with an authenticator app, which your organisation can require for administrators. Repeated failed attempts cause a lockout, easily guessed passwords are refused, and reset links are short-lived and work once.
You can see your sessions
Each person can see their devices and recent activity, with failed attempts flagged, and end sessions on other devices. Registration is by invitation, not open to the public.
Encrypted connections
Traffic is encrypted, and browsers are told to use only encrypted connections. Security headers go with every response, and private files are refused.
Careful with uploads
Files are checked by name and by content. Scripts, programs and other risky types are refused, and uploaded files are kept out of search engines.
A record of changes
Nothing issued is lost. An edited record keeps what it said before, and everyone on the contract is told. Permission changes record who, when and why.
No third-party trackers
The app's fonts and scripts are served from our own systems, so your browser does not send your details to font or script networks.
How we check it
The application has had a full security review, the findings have been fixed, and it has been tested with an industry-standard web security testing tool. An automated test suite covers the app's behaviour, and permission and company-separation checks are part of it.
When our support team needs to help
If support has to see an account as a user to solve a problem, it is recorded, with a banner shown throughout. Corrections to records are shown on the record with the reason, and everyone on the contract is told.
AI, only if you want it
The AI assistants are off until they are switched on for your account. When on, the text of the relevant contract records goes to our AI provider to answer a question. They work only from contracts the person is assigned to. They are never given other contracts, other companies, drafts, the client side's private notes or user account tables, and e-mail addresses and phone numbers in record text are removed. Payment figures go only to people allowed to view them. Every answer is advice for a person to check: the assistants never send anything themselves.
If something goes wrong
We keep a recorded process for security incidents, including the time limit for reporting a personal data breach to the Information Commissioner's Office. We can tell affected users what happened and who was affected.
What to ask us
If you need answers for a supplier questionnaire, such as hosting, backups, data location or certifications, ask during your demo or through our contact page. We will answer them directly and in writing, rather than making broad claims here.
This website is separate from the software. It is covered by our privacy notice.
Bring your security questions
Your IT or data protection lead is welcome at the demo.