Contract UpliftSecurity
Security controls for contractual revenue operations.
Contract Uplift is built to keep workspace data separated, authenticated access controlled and material operational actions traceable.
Security at Contract Uplift
We use a layered application design for authentication, workspace access and operational workflow controls. This page describes controls implemented in the current application; it is not a catalogue of certifications or security guarantees.
Authentication & sessions
Firebase Authentication verifies sign-in credentials and supported providers. After verification, Contract Uplift creates its own opaque application session. The raw session token is not stored in D1; only a SHA-256 hash is retained. In production, session cookies are Secure, HttpOnly, host-only and SameSite=Lax.
Workspace isolation & access control
Application access is derived from the authenticated session and active workspace membership. Service queries are scoped to the workspace, and database relationship constraints protect key cross-workspace relationships. Authenticated HTML responses are marked private, no-store.
Application and webhook protections
Relevant state-changing application routes enforce same-origin request protection. Resend delivery webhooks and billing-provider webhooks are signature-verified before processing, with deduplication and idempotency handling for repeat deliveries.
Audit & operational logging
Material application actions are recorded in an application-level append-only audit history. Structured application logging is designed to avoid request bodies, headers, secrets and business-record content.
Environment separation
Staging and production use separate Firebase, D1 and KV environments. Sensitive runtime values are supplied as Worker environment secrets rather than stored in the application source.
Security/contact note
Contract Uplift does not currently claim security certifications, an immutable audit ledger, a specific data-residency commitment or a service-level agreement. For a security question about the product, contact security@contractuplift.com.