Security Policy

1. Basic policy

AgreePack handles information related to consent collection and evidence organization. We implement access control, authentication, operational monitoring, and support within the necessary scope, and continuously work to improve the service.

2. Main information handled

To provide the service, AgreePack may handle the following information.

• Account information, email addresses, and workspace information.
• Uploaded documents and document version information.
• Consent requests, consent timestamps, IP addresses, User-Agent information, and other consent history records.
• Operation histories, audit logs, and information related to evidence pack generation.
• Billing status, plan information, and information necessary for Stripe integration.

3. Access control and account management

We separate access scopes by role and workspace so that users do not access information unintentionally.

• Login authentication and email verification are required.
• The normal app area controls access by the workspace to which the user belongs.
• The operations area is separated from the normal app area and is accessible only to accounts with operator privileges.
• Ops users and App users are generally operated separately.
• In production, additional Basic Authentication is configured for the operations area.

4. Operational security management

To support stable service operation and investigation when issues occur, we apply the following operational practices.

• Communication is encrypted using HTTPS.
• APP_DEBUG is disabled in production.
• Operation histories and audit logs are stored to make the background of consent and evidence easier to review.
• Backup procedures, log checks, and error notifications are continuously maintained and improved.
• Unnecessary public APIs and debug routes are not enabled in production.

5. Evidence and legal effect

AgreePack is a service for keeping records that make it easier to explain who consented to which document and when. It is not an electronic signature service itself and does not uniformly guarantee legal effect or evidentiary value.

For important contracts or dispute-related use, please consult a lawyer or other qualified professional as necessary.

6. Security-related contact

If you have found a bug, unexpected behavior, or a security concern, please contact us through the contact page .