Security practices evolve as Vellum grows. What follows is what the product actually does today, not a certification list.
01
Every client, contract, invoice, payment, document, and audit event belongs to one organization. Queries for org-owned data check membership in that organization. Client-provided organization IDs are not trusted.
02
People sign in with their account. Sessions are the source of truth for the current user and organization. Auth endpoints are rate-limited.
03
Protected operations check live membership and role on the server. Loading another organization's contract by ID fails closed.
04
A signed PDF is stored as bytes with a SHA-256 identity. Branding and template edits apply to future renders. Stored signed bytes are not rewritten.
05
Important actions append an activity event. The application does not edit those events after write.
06
On-demand backups dump PostgreSQL and copy the upload tree together. Restore verification checks signed-PDF hashes, snapshots, payments, audit, uploads, and tenant isolation. Point-in-time recovery is not claimed for local Compose.
07
PostgreSQL is the database. Rate-limit storage can use Redis when REDIS_URL is set, otherwise an in-memory store. Health checks exist for operators. This page does not claim SOC 2, GDPR certification, HIPAA, or PCI.
08
Portal invitations use hashed, expiring tokens. Portal-token endpoints are rate-limited. Clients receive email only and are never treated as organization members. Raw tokens are not placed in notification payloads.
The portal opens an issued snapshot. Consent, identity details, document hashes, and timestamps are stored as evidence. That is a technical record. It is not a claim that a signature is legally binding in every jurisdiction.
Client invitation
Expires in 7 days
Harbor & Co.
Elena Voss can review the issued snapshot from a private link. The client is not added as a workspace member.
Sample invitation chrome. Tokens are hashed in the product and never shown in emails as raw secrets.
Northwind Studio
Secure review
Issued snapshot v1
Marketing Services Agreement
The PDF is generated from the version that was issued. Later template or draft edits do not change it.
Sample client portal. Signing records consent against the pinned snapshot.
Create, send, view, sign, invoice, pay, invite, and role changes are written to the organization activity history. Sensitive secrets are not shown in that timeline.
Activity
Contract issued
12 Aug 2026, 14:22 UTC
Issued · Contract · Jonah Hale
Signature completed
12 Aug 2026, 16:04 UTC
Completed · Contract · Elena Voss
Payment recorded
18 Aug 2026, 09:11 UTC
Recorded · Payment · Priya Raman
Append-only activity history. Sample events, not a live log.
Create your first professional contract and keep the rest of the workflow in one place.