What happens to your confidential documents.

Each workspace has its own encryption key. Every document you upload, every contract version held as a file, and every executed signed PDF is encrypted with that key using AES-256 before it is stored. The key itself is held encrypted and is only unwrapped to serve your own workspace's request.

A stored file taken on its own is unreadable, and one customer's key has no relationship to another's. A stray copy or a lost backup yields ciphertext rather than contracts.

Files are served to an authenticated member of the workspace that owns them and to nobody else. We do not publish public or long-lived addresses for customer documents, so there is no link that keeps working after somebody leaves.

The exception is a review link you deliberately create to send a contract outside your organisation. Those are single-purpose, carry an expiry, and can be revoked at any time.

Every request carries the workspace it belongs to and the role of the person making it. That is checked when the request arrives and again in the logic that answers it: the first check fails fast, the second catches any mistake in the first.

There is no cross-customer view, no shared library, and no internal console that reaches across workspaces. Membership of a workspace is by invitation from an administrator inside it, within a seat limit, and carries one of three roles: administrator, partner and member.

The drafting and review features run inside our own enterprise cloud environment under a commercial agreement, never on a consumer AI account. Your contracts are not used to train any model, are not retained by anyone to improve one, and are never pooled or shared between customers. No third party gets to learn anything from your agreements.

Customer content is stored and processed in a single region, which we name in your contract, in facilities certified to recognised international standards for physical and operational security. We do not currently offer a per-customer choice of region. Where residency in a particular jurisdiction is a hard requirement for you, raise it on the demo and we will tell you honestly whether we can meet it.

Your organisation is the controller of the personal data you put into the product and we act as your processor, on your instructions and for no other purpose. We will sign a Data Processing Agreement, and we operate to the standards set by the GDPR and equivalent data protection regimes.

Every change to a contract writes an entry: created, shared, opened, approved, declined, revoked, redlined, deviation accepted, signed, executed, voided. Each carries a person and a timestamp, readable from the contract and from an organisation-wide log available to administrators.

Each signature records the signer's name, email, method, time and IP address, together with a hash of the exact text they saw, so an edit made afterwards cannot change what was signed.

Before a signature can be applied, the signer enters a code we email to the address the request was sent to. It lasts fifteen minutes, is accepted five times at most, and is single use. That proves whoever signed also reached that mailbox at that moment. It is not an identity check and we do not present it as one.

Once every signatory has signed, the executed document is rendered once and we record a SHA-256 digest of that exact file. Any copy produced later can be checked against it byte for byte.

Each entry in the log also carries a digest computed over its own contents and over the digest of the entry before it, so altering or removing one entry breaks every link after it. Tampering with the record is therefore detectable, which is what a dispute turns on.

The product interface loads no third-party analytics, no advertising tags and no external tracking scripts. Application logs carry identifiers rather than the contents of documents, comments or client records.

Deleting a contract removes its versions, obligations, reviews, comments and signature records, along with the encrypted files behind them. Deleting a workspace does the same for everything inside it.

Karyalo runs as a hosted service, which is what almost every organisation wants. Where a mandate calls for something else, a dedicated instance, a specific hosting region, or a deployment inside your own environment, we will scope it with you rather than sell you a checkbox.

Bring your security questionnaire to the demo. We will answer it directly, in writing, and we would rather tell you plainly where a requirement lands than have you discover it during implementation.