Contract security review before you sign
Essentials and upBefore you sign, upload the contract as a PDF or Word file. SimpleAudit finds the security terms, such as breach notice, encryption, access, subprocessors, audit rights and data retention, and checks each one against your approved policies. Every clause is marked Covered, with the matching quote from your policy, Partly covered, or Not covered. Each gap comes with a suggested fix and the reason for it, so you know whether to update your policy or ask for different wording. Price, payment and liability terms are left to your legal team.
2 a year on Essentials. Unlimited on Pro.
Updated
Read the transcript
Exhibit C. Your customer's security exhibit says you will report a breach within 24 hours. Your policy says 72. Legal reads the liability clause and sales reads the price. Nobody reads Exhibit C, and you sign a promise you don't keep. SimpleAudit marks every security clause Covered, Partly covered or Not covered, and quotes your policy where it is covered. Each gap says how to fix it: update your policy when the ask is normal, or push back with replacement wording when it goes beyond SOC 2 norms for a company your size. On a supplier's contract, it asks for stronger terms and never lowers your bar. You sign knowing every security promise in the contract is one you already keep.
Their legal team attached Exhibit C
Exhibit C
The moment
Your customer's security exhibit says you will report a breach within 24 hours. Your policy says 72.
Without SimpleAudit
Legal reads the liability clause and sales reads the price. Nobody reads Exhibit C, and you sign a promise you don't keep.
With SimpleAudit
SimpleAudit marks every security clause Covered, Partly covered or Not covered, and quotes your policy where it is covered. Each gap says how to fix it: update your policy when the ask is normal, or push back with replacement wording when it goes beyond SOC 2 norms for a company your size. On a supplier's contract, it asks for stronger terms and never lowers your bar.
The outcome
You sign knowing every security promise in the contract is one you already keep.
How it works
Upload the contract
Drop in the PDF or Word file before you sign. Link it to a vendor if it is a supplier contract.
Read it clause by clause
See each security clause marked Covered, Partly covered or Not covered, with your policy quote or the gap explained.
Close the gaps
Update your policy with the suggested wording, or send the replacement wording back to the other side. Then sign.
Key capabilities
Covered, Partly covered or Not covered
Each security clause gets one of three plain answers. A covered clause shows the exact quote from your approved policy, and SimpleAudit checks that the quote is really there.
A fix for every gap
Each gap comes with suggested policy wording and suggested contract wording, and says which to lead with. When the ask is normal for a company your size, update your policy. When it goes beyond SOC 2 norms, push back with the replacement wording.
Supplier contracts run the other way
Link a contract to one of your vendors and SimpleAudit reviews it as a supplier contract. There the only fix is to ask the supplier for stronger terms. It never suggests lowering your own policy to match a supplier.
Security terms only
Breach notice, encryption, access, subprocessors, audit rights, retention and continuity are checked. Price, payment, intellectual property and liability are left to your lawyers unless they carry a security promise.
Ranked by audit risk
Each finding is marked high, medium or low, so you know which gaps to raise before you sign.
Why we built it this way
“Security exhibits get signed because nobody on the deal is paid to read them. Then your auditor asks how you meet the 24-hour breach notice you agreed to, and the honest answer is that you don't. I wanted every security promise checked against your own policies before the signature, with a clear next step for each gap.”
Joe, Founder
Frequently asked questions
What is a security exhibit in a customer contract?
It is the part of a contract, often called Exhibit C or a security schedule, that lists the security promises you make to your customer: how fast you report a breach, how data is encrypted, who can access it, which subprocessors you use, whether the customer can audit you and how long data is kept. It binds you like the rest of the contract, so a promise there that your policies do not back is one you may not keep.
Does SimpleAudit replace a lawyer for contract review?
No. SimpleAudit checks only the security terms against your approved policies. Price, payment, intellectual property and liability are left to your legal team unless they carry a security promise.
Can I check a supplier's contract too?
Yes. Link the contract to one of your vendors and SimpleAudit reviews it as a supplier contract. There the only fix it offers is to ask the supplier for stronger terms. It never suggests lowering your own policy to match a supplier.
Related Resources
Ready to try Contract Review?
Included on Essentials and up. 2 a year on Essentials. Unlimited on Pro. Start a 7-day free trial on Pro to use Contract Review during your trial. On Essentials, your yearly allowance starts when your subscription does. No credit card required.