Built for procurement review.
Tenant isolation, encryption, and audit logging are designed into Manifesto from the data layer up. This page is a plain-language overview of our posture; a detailed security package — architecture, subprocessors, and questionnaire responses — is available to customers and prospects on request.
Tenant isolation
Your data is logically isolated per organization and enforced at the database layer on every request — there are no cross-tenant reads. An account only ever sees its own contracts, rates, and exports.
Encryption
- Encrypted in transit (modern TLS) between your browser, our API, and storage.
- Encrypted at rest — PDFs, templates, and exports in object storage, and all database contents.
- Secrets and credentials are managed by the deployment platform, never committed to source.
Authentication & access control
Sign-in is handled by a managed identity provider with support for email + password, magic links, and SSO / OAuth. Every request is authenticated and scoped to an active organization. Role-based access — admin, reviewer, and viewer — gates sensitive actions such as uploads, edits, deletions, and reprocessing.
Audit logging & traceability
Every insertion, edit, and deletion is captured with the actor, timestamp, a field-level diff, and the source (pipeline run, manual edit, or amendment). Pipeline runs and reviewer actions are logged end-to-end — so every extracted value can be traced back to who produced it and to the exact line in the source PDF it came from.
Data residency
Production data is hosted with a major cloud provider. Regional residency (including the EU) is available and configured per organization at onboarding.
Reporting a vulnerability
If you believe you have found a security vulnerability, please email security@manifesto.app. We respond within one business day.
On the roadmap
- SOC 2 Type II.
- Security one-pager (PDF) and a questionnaire response pack.
- Customer-managed encryption keys for enterprise plans.
Need our detailed architecture, subprocessor list, or a completed security questionnaire? We share those with customers and prospects under NDA — contact us.