Security overview

Updated October 24, 2026

Estoppel certificates are relied on by buyers and lenders, so EstoppelBot is built to keep each workspace’s data private and every signed record intact. A full security review was completed before launch.

Access

Every row of workspace data is protected by database row-level security: members see only their own workspace, with role-based permissions (owner, admin, paralegal, reviewer, viewer) enforced in the database itself, not just the app. The public browser key has no direct database access. Sign-in is by one-time email link or Google; there are no passwords to steal.

Tenant links

Tenants respond through a unique link carrying a 192-bit random token. Links are served only by our servers, rate limited, never indexed or cached, expire automatically, and stop working when a request is voided or answered.

Signed records

Lease terms are frozen when a request is sent. Tenant responses and issued certificates are append-only: no one, including workspace owners, can edit or delete them. A certificate can be issued only after a person approves the tenant’s response, and must quote every tenant exception verbatim.

Sharing with lenders and buyers

Packet links use 256-bit tokens stored only as hashes, expire within 31 days, can be revoked at any time, and count how often and when they were last opened.

Connected AI apps

Members can connect an AI app (such as Claude or ChatGPT) to their workspace. Connections use OAuth with PKCE and short-lived, rotating tokens stored only as hashes, limited to one workspace and to the member’s own role and deals; the approval screen shows exactly where access is going and asks you to type the address of any site it doesn’t recognise. Access is read-only unless an owner or admin lets AI apps prepare work and the member allows it for that connection. Even then, an app can only propose anything that emails a tenant or makes a legal record (sending requests, reminders, answers, approvals, certificates, closing a deal): a member approves each one, and it runs as that member. Every step an app runs or proposes is recorded. Owners and admins can turn this off for the whole workspace.

Infrastructure

Data is encrypted in transit (TLS) and at rest, and hosted in the United States. Uploaded deal documents are kept in private storage and downloaded only through short-lived links after a membership check. Secrets such as a workspace’s own AI key are held in an encrypted vault and never returned to the browser. Pages use a strict content security policy and security headers. Email is sent from a domain with SPF, DKIM and DMARC.

Reporting a vulnerability

Please contact the Bleek Vision team via bleekvision.com. We appreciate responsible disclosure.